Having secured the frontend and also embedded a session ID in every gateway call to the backend, we can shift our focus to securing those backend services.
Let's start with the images service. First of all, we need to configure session management by creating SessionConfig as follows:
@EnableMongoWebSession
public class SessionConfig {
}
This preceding code can be described as follows:
- @EnableMongoWebSession activates the Reactor-based Spring Session MongoDB
Next, we can lock things down by creating a SecurityConfiguration class like this:
@EnableWebFluxSecurity
@EnableReactiveMethodSecurity
public class SecurityConfiguration {
@Bean
SecurityWebFilterChain springWebFilterChain() {
return HttpSecurity.http()
.securityContextRepository(
new WebSessionSecurityContextRepository...