Following scenario:
DESCRIPTION:
I develop two microservices with Spring. One Service is the auth service and generates the session. The other service is the ui-service which needs to know if a requesting client is authorized. After some reading I found out that sharing the session with redis seems to be a good solution. (Correct me if there is a better way )
For the coding I followed the example here
Status quo:
My auth service works and generates a session in redis:
For example:
127.0.0.1:6379> keys *
1) "spring:session:sessions:a4c11990-94a4-4b99-bc77-33f2084e5e8f"
2) "spring:session:sessions:expires:a4c11990-94a4-4b99-bc77-33f2084e5e8f"
3) "spring:session:sessions:26f24541-74dd-4410-84ac-d051a64d1263"
4) "spring:session:index:org.springframework.session.FindByIndexNameSessionRepository.PRINCIPAL_NAME_INDEX_NAME:userA"
5) "spring:session:expirations:1557314160000"
6) "spring:session:sessions:expires:26f24541-74dd-4410-84ac-d051a64d1263"
Now I want to call a test endpoint of my ui service. This call should be successfull if the session is valid and access denied when there is no valid session.
Atm I always get an access denied error in my ui service.
Code:
My auth service:
application.properties
spring.session.store-type=redis
spring.session.redis.flush-mode=on-save
spring.session.redis.namespace=spring:session
spring.redis.host=localhost
spring.redis.port=6379
pom.xml
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-redis</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.session</groupId>
<artifactId>spring-session-data-redis</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.session</groupId>
<artifactId>spring-session</artifactId>
<version>1.3.5.RELEASE</version>
</dependency>
SessionConfig
@Configuration
@EnableRedisHttpSession
public class SessionConfig extends AbstractHttpSessionApplicationInitializer {
@Bean
public JedisConnectionFactory jedisConnectionFactory() {
return new JedisConnectionFactory();
}
@Bean
public HttpSessionIdResolver httpSessionIdResolver() {
CookieHttpSessionIdResolver resolver = new CookieHttpSessionIdResolver();
DefaultCookieSerializer cookieSerializer = new DefaultCookieSerializer();
cookieSerializer.setUseBase64Encoding(false);
resolver.setCookieSerializer(cookieSerializer);
return resolver;
}
and in my main class I did
@EnableRedisHttpSession
And in my UI Service:
pom.xml
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.1.4.RELEASE</version>
<relativePath /> <!-- lookup parent from repository -->
</parent>
<groupId>com.test</groupId>
<artifactId>Redistest</artifactId>
<version>0.0.1-SNAPSHOT</version>
<name>Redistest</name>
<description>Microservice for Data Management</description>
<properties>
<java.version>1.8</java.version>
</properties>
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-redis</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.session</groupId>
<artifactId>spring-session-data-redis</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.session</groupId>
<artifactId>spring-session</artifactId>
<version>1.3.5.RELEASE</version>
</dependency>
<dependency>
<groupId>redis.clients</groupId>
<artifactId>jedis</artifactId>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
</plugin>
</plugins>
</build>
</project>
main:
@EnableWebSecurity
@SpringBootApplication
public class RedistestApplication {
public static void main(String[] args) {
SpringApplication.run(RedistestApplication.class, args);
}
SessionConfig:
@Configuration
@EnableRedisHttpSession
public class SessionConfig extends AbstractHttpSessionApplicationInitializer {
@Bean
public JedisConnectionFactory jedisConnectionFactory() {
return new JedisConnectionFactory();
}
@Bean
public HttpSessionIdResolver httpSessionIdResolver() {
return HeaderHttpSessionIdResolver.xAuthToken();
}
WebSecurity:
@Configuration
public class WebSecurity extends WebSecurityConfigurerAdapter{
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.anyRequest().authenticated();
}
}
}
Controller
@RestController
public class TestController {
@GetMapping("/name")
public String getName() {
return "Hallo From Test";
}
}
QUESTION:
I'm not getting any error in my services. It seems like I just can't use the session from reddis. In the tutorial the author says that there might be a problem with the base64 encoding of the session-id in the cookie. I guess this might be the problem. Do you have any suggestion or see any error in my implementation? Do I have to disable the HttpSession exlipcitly?
Thank's for your help/hints.
EDIT:
I just recognized that in my browser Inspect (Firefox) i'm not having any "x-auth" field. My intention is to save the auth id (Session-id) in the header not as a cookie. So I expect that my auth service should set the sessionid as x-auth field in the header. Is that correct? So the error seems to come from the auth service?
