I have service A which configured using spring security, config:
@Configuration
@EnableWebSecurity
@EnableMethodSecurity(
securedEnabled = true,
jsr250Enabled = true
)
@SecurityScheme(
name = "bearerAuth",
type = SecuritySchemeType.HTTP,
bearerFormat = "JWT",
scheme = "bearer"
)
@RequiredArgsConstructor
public class SecurityConfig {
private final JwtTokenFilter jwtTokenFilter;
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.csrf(AbstractHttpConfigurer::disable)
.cors(AbstractHttpConfigurer::disable)
.sessionManagement(httpSecuritySessionManagementConfigurer ->
httpSecuritySessionManagementConfigurer.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
.authorizeHttpRequests(req -> req
.requestMatchers(
"/login/**",
).permitAll()
.anyRequest().authenticated())
.addFilterBefore(jwtTokenFilter, UsernamePasswordAuthenticationFilter.class);
return http.build();
}
Service A receives requests form front-end, and send request to another backend service B using FeignClient:
@Service
public class UserService {
@Autowired
private SlApiClient slApiClient;
public CustomerDTO getCustomerById(UUID id) {
return slApiClient.getCustomerById(id;
}
/**
* Another methods using slApiClient
*/
}
Feign client:
@FeignClient(url = "${endpoints.sl-api-uri}", name = "SL-API-CLIENT-V1", primary = false)
public interface SlApiClient {
@GetMapping("/users/{id}}")
@PreAuthorize("hasAuthority('users.read')")
CustomerDTO getCustomerById(@PathVariable UUID id);
/**
* Another methods
*/
}
So my question is how to awoid PreAuthorize security check for this inner call from service A to service B via FeignClient