I have Spring Gateway 2023.0.3 project which I want to configure to limit only internally to forward headers from network requests. Example request:

API client -> Spring gateway -> Spring Authorization server

After that Spring gateway gets Bearer token and makes requests to microservices.

I managed to make it work by adding:

@Component
@Order(2)
public class CustomAuthorizationFilter extends AbstractGatewayFilterFactory<CustomAuthorizationFilter.Config> {

    public CustomAuthorizationFilter() {
        super(Config.class);
    }

    @Override
    public GatewayFilter apply(Config config) {
        return (exchange, chain) -> {
            final StringBuilder jwtToken = new StringBuilder();
            exchange.getRequest().getHeaders().forEach((headerName, headerValues) -> {
                for (String value : headerValues) {
                    if (value.contains("Bearer")) {
                        System.out.println("Header with Bearer token found: " + headerName + " = " + value);
                        jwtToken.append(value);
                    }
                }
            });

            exchange.getRequest().mutate()
                        .header("Authorization", jwtToken.toString())
                        .build();

            return chain.filter(exchange);
        };
    }

    public static class Config {
    }

}

…..

  routes:
    - id: auth
      uri: lb://internal
      predicates:
        - Path=/platform/**
      filters:
        - name: CircuitBreaker
        - name: CustomAuthorizationFilter
          args:
            name: auth
        - RemoveResponseHeader=Cookie

Into very old version of Spring gateway it’s working fine. But now request is not forwarded properly. I need to add and allow CustomAuthorizationFilter. It’s a security issue because external API clients should not be allowed to pass requests with Bearer token. Do you know any possible solution?