如何在JHipster生成的JWT认证应用中实现安全服务间通信？

Hey Michele, great question! You’re right that @AuthorizedFeignClient is built specifically for OAuth2 setups, but there are simple, effective ways to handle secure service-to-service calls in a JWT-generated JHipster application. Let’s break down the most practical approaches:

1. Pass User JWT Tokens via a Custom Feign Interceptor #

If your service calls are triggered by an authenticated user (like a frontend request kicking off a backend chain), you can forward the user’s existing JWT token to the target service using a Feign interceptor:

• Build a custom Feign RequestInterceptor:
  Implement RequestInterceptor to pull the JWT from the current security context and inject it into the Feign request headers:

  import feign.RequestInterceptor;
  import feign.RequestTemplate;
  import org.springframework.security.core.Authentication;
  import org.springframework.security.core.context.SecurityContextHolder;
  import org.springframework.security.oauth2.jwt.Jwt;
  import org.springframework.stereotype.Component;
  
  @Component
  public class JwtFeignInterceptor implements RequestInterceptor {
      @Override
      public void apply(RequestTemplate template) {
          Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
          if (authentication != null && authentication.getPrincipal() instanceof Jwt) {
              Jwt jwt = (Jwt) authentication.getPrincipal();
              template.header("Authorization", "Bearer " + jwt.getTokenValue());
          }
      }
  }
  

• Attach the interceptor to your Feign client:
  You can link it to a specific client or set it up globally. For a single client:

  import org.springframework.cloud.openfeign.FeignClient;
  import org.springframework.web.bind.annotation.GetMapping;
  
  @FeignClient(name = "target-service", configuration = JwtFeignInterceptor.class)
  public interface TargetServiceClient {
      @GetMapping("/api/protected-resource")
      String getProtectedResource();
  }
  

2. Use a Service Account JWT for Background Service Calls #

For calls that don’t involve a user context (like scheduled jobs or internal syncs), create a dedicated service account and fetch a JWT for it to authenticate between services:

• Set up a restricted service account:
  Create a user in your JHipster app with service-specific permissions (e.g., ROLE_SERVICE). Store its credentials securely in environment variables or a config server—never hardcode them.

• Fetch and cache the service JWT:
  Build a utility class to call your app’s /api/authenticate endpoint with the service account credentials, retrieve the JWT, and cache it (with logic to refresh it when it’s about to expire). Then use this token in your Feign interceptor instead of the user’s token.

• Example service account interceptor:

  @Component
  public class ServiceAccountFeignInterceptor implements RequestInterceptor {
      private final ServiceAuthTokenProvider tokenProvider;
  
      public ServiceAccountFeignInterceptor(ServiceAuthTokenProvider tokenProvider) {
          this.tokenProvider = tokenProvider;
      }
  
      @Override
      public void apply(RequestTemplate template) {
          String serviceJwt = tokenProvider.getValidToken();
          template.header("Authorization", "Bearer " + serviceJwt);
      }
  }
  

3. Ensure the Target Service Validates the JWT #

Whichever method you choose, confirm the target service is set up to validate incoming JWT tokens:

• JHipster’s default JWT setup includes a JWTFilter that handles token validation out of the box, but double-check your protected endpoints use @PreAuthorize or role-based access controls to enforce permissions.
• Verify the JWT’s issuer, signature, and audience are valid (JHipster handles this automatically if all services share the same JWT secret).

Quick Best Practices #

• Handle token expiry: For service account tokens, add a refresh mechanism to avoid downtime when the token expires.
• Least privilege principle: Assign only the necessary permissions to service accounts to minimize risk if credentials are compromised.
• Monitor token usage: Keep an eye on service-to-service token flows to catch unusual activity early.

内容的提问来源于stack exchange，提问作者Michele Mazza