added security layer in api-gateway

Author: Yash-vs9

api-gateway/pom.xml

@@ -21,6 +21,23 @@
             <groupId>org.springframework.cloud</groupId>
             <artifactId>spring-cloud-starter-netflix-eureka-client</artifactId>
         </dependency>
+        <dependency>
+            <groupId>io.jsonwebtoken</groupId>
+            <artifactId>jjwt-api</artifactId>
+            <version>0.11.5</version>
+        </dependency>
+        <dependency>
+            <groupId>io.jsonwebtoken</groupId>
+            <artifactId>jjwt-impl</artifactId>
+            <version>0.11.5</version>
+            <scope>runtime</scope>
+        </dependency>
+        <dependency>
+            <groupId>io.jsonwebtoken</groupId>
+            <artifactId>jjwt-jackson</artifactId>
+            <version>0.11.5</version>
+            <scope>runtime</scope>
+        </dependency>
     </dependencies>
 
     <build>

api-gateway/src/main/java/com/streamseat/apigateway/filter/AuthenticationFilter.java

@@ -0,0 +1,59 @@
+package com.streamseat.apigateway.filter;
+
+import org.springframework.http.HttpHeaders; // Use Spring's HttpHeaders
+import com.streamseat.apigateway.utils.JwtUtil;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.cloud.gateway.filter.GatewayFilter;
+import org.springframework.cloud.gateway.filter.factory.AbstractGatewayFilterFactory;
+import org.springframework.http.server.reactive.ServerHttpRequest;
+import org.springframework.stereotype.Component;
+
+@Component
+public class AuthenticationFilter extends AbstractGatewayFilterFactory<AuthenticationFilter.Config> {
+
+    @Autowired
+    private RouteValidator validator; // Simple class to skip auth for /login or /register
+    @Autowired
+    private JwtUtil jwtUtil;
+
+    public AuthenticationFilter() {
+        super(Config.class);
+    }
+
+    @Override
+    public GatewayFilter apply(Config config) {
+        return ((exchange, chain) -> {
+            if (validator.isSecured.test( exchange.getRequest())) {
+                // 1. Check Header
+                if (!exchange.getRequest().getHeaders().containsKey(HttpHeaders.AUTHORIZATION)) {
+                    throw new RuntimeException("Missing Authorization Header");
+                }
+
+                String authHeader = exchange.getRequest().getHeaders().get(HttpHeaders.AUTHORIZATION).get(0);
+                if (authHeader != null && authHeader.startsWith("Bearer ")) {
+                    authHeader = authHeader.substring(7);
+                }
+
+                try {
+                    // 2. Validate
+                    jwtUtil.validateToken(authHeader);
+
+                    // 3. Extract & Inject Header for internal microservices
+                    String userId = jwtUtil.extractUserId(authHeader);
+                    ServerHttpRequest request = exchange.getRequest()
+                            .mutate()
+                            .header("X-User-Id", userId)
+                            .build();
+
+                    return chain.filter(exchange.mutate().request(request).build());
+
+                } catch (Exception e) {
+                    throw new RuntimeException("Unauthorized access");
+                }
+            }
+            return chain.filter(exchange);
+        });
+    }
+
+    public static class Config {}
+}

api-gateway/src/main/java/com/streamseat/apigateway/filter/RouteValidator.java

@@ -0,0 +1,23 @@
+package com.streamseat.apigateway.filter;
+
+import org.springframework.http.server.reactive.ServerHttpRequest;
+import org.springframework.stereotype.Component;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.function.Predicate;
+
+@Component
+public class RouteValidator {
+    public static final List<String> openApiEndpoints = Arrays.asList(
+            "/auth/register",
+            "/auth/token",
+            "/eureka",
+            "/api/events" // ADD THIS LINE
+    );
+
+    public Predicate<ServerHttpRequest> isSecured =
+            request -> openApiEndpoints
+                    .stream()
+                    .noneMatch(uri -> request.getURI().getPath().contains(uri));
+}

api-gateway/src/main/java/com/streamseat/apigateway/utils/JwtUtil.java

@@ -0,0 +1,46 @@
+package com.streamseat.apigateway.utils;
+
+import io.jsonwebtoken.Jwts;
+import io.jsonwebtoken.SignatureAlgorithm;
+import io.jsonwebtoken.io.Decoders;
+import io.jsonwebtoken.security.Keys;
+import org.springframework.stereotype.Component;
+
+import java.security.Key;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.Map;
+
+@Component
+public class JwtUtil {
+    // In production, move this to AWS Secrets Manager or environment variables
+    private static final String SECRET = "5367566B59703373367639792F423F4528482B4D6251655468576D5A71347437";
+
+    public void validateToken(final String token) {
+        Jwts.parserBuilder().setSigningKey(getSignKey()).build().parseClaimsJws(token);
+    }
+
+    public String extractUserId(String token) {
+        return Jwts.parserBuilder().setSigningKey(getSignKey()).build()
+                .parseClaimsJws(token).getBody().getSubject();
+    }
+
+    private Key getSignKey() {
+        byte[] keyBytes = Decoders.BASE64.decode(SECRET);
+        return Keys.hmacShaKeyFor(keyBytes);
+    }
+
+    public String generateToken(String userName) {
+        Map<String, Object> claims = new HashMap<>();
+        return createToken(claims, userName);
+    }
+
+    private String createToken(Map<String, Object> claims, String userName) {
+        return Jwts.builder()
+                .setClaims(claims)
+                .setSubject(userName)
+                .setIssuedAt(new Date(System.currentTimeMillis()))
+                .setExpiration(new Date(System.currentTimeMillis() + 1000 * 60 * 30))
+                .signWith(getSignKey(), SignatureAlgorithm.HS256).compact();
+    }
+}

api-gateway/src/main/resources/application.properties

@@ -1,17 +1,17 @@
 spring.application.name=api-gateway
 server.port=8082
 
-# 1. FIX: Use the service name defined in docker-compose
-eureka.client.service-url.defaultZone=${EUREKA_URL:http://discovery-server:8761/eureka/}
+# 1. Eureka Configuration
+eureka.client.service-url.defaultZone=http://localhost:8761/eureka/
 
-# 2. PRO TIP: Use UPPERCASE for service names in lb://
-# Eureka usually registers names in uppercase by default.
+# 2. Event Service Route + Security Filter
 spring.cloud.gateway.routes[0].id=event-service
 spring.cloud.gateway.routes[0].uri=lb://EVENT-SERVICE
 spring.cloud.gateway.routes[0].predicates[0]=Path=/api/events/**
+spring.cloud.gateway.routes[0].filters[0]=AuthenticationFilter
 
+# 3. Booking Service Route + Security Filter
 spring.cloud.gateway.routes[1].id=booking-service
 spring.cloud.gateway.routes[1].uri=lb://BOOKING-SERVICE
 spring.cloud.gateway.routes[1].predicates[0]=Path=/api/bookings/**
-
-eureka.instance.prefer-ip-address=true
+spring.cloud.gateway.routes[1].filters[0]=AuthenticationFilter

booking-service/src/main/java/com/streamseat/bookingservice/client/FeignClientInterceptor.java

@@ -0,0 +1,21 @@
+package com.streamseat.bookingservice.client;
+
+import feign.RequestInterceptor;
+import feign.RequestTemplate;
+import org.springframework.stereotype.Component;
+import org.springframework.web.context.request.RequestContextHolder;
+import org.springframework.web.context.request.ServletRequestAttributes;
+
+@Component
+public class FeignClientInterceptor implements RequestInterceptor {
+    @Override
+    public void apply(RequestTemplate template) {
+        ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
+        if (attributes != null) {
+            String userId = attributes.getRequest().getHeader("X-User-Id");
+            if (userId != null) {
+                template.header("X-User-Id", userId);
+            }
+        }
+    }
+}

event-service/src/main/java/com/streamseat/eventservice/service/EventService.java

@@ -4,10 +4,10 @@
 import com.streamseat.eventservice.dto.SeatType;
 import com.streamseat.eventservice.model.Event;
 import com.streamseat.eventservice.repository.EventRepository;
-import jakarta.transaction.Transactional;
 import lombok.RequiredArgsConstructor;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
 
 @Service
 @RequiredArgsConstructor

event-service/src/main/resources/application.properties

@@ -2,15 +2,22 @@ spring.application.name=event-service
 server.port=8081
 
 # Eureka Connection
-eureka.client.service-url.defaultZone=http://discovery-server:8761/eureka/
-spring.datasource.url=${SPRING_DATASOURCE_URL:jdbc:mysql://localhost:3306/stream_seat_db}
-spring.datasource.username=${SPRING_DATASOURCE_USERNAME:root}
-spring.datasource.password=${SPRING_DATASOURCE_PASSWORD:root}
+# FIX: Ensure this is on its own line
+eureka.client.service-url.defaultZone=http://localhost:8761/eureka/
+# Database Connection
+# FIX: Ensure this starts on a new line
+spring.datasource.url=jdbc:mysql://localhost:3306/stream_seat_db?createDatabaseIfNotExist=true
+spring.datasource.username=root
+spring.datasource.password=kesh@v123
+spring.jpa.hibernate.ddl-auto=create
+
+# JPA / Hibernate Config
+spring.jpa.database-platform=org.hibernate.dialect.MySQLDialect
+spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
+spring.jpa.properties.hibernate.boot.allow_jdbc_metadata_access=false
 
-spring.jpa.hibernate.ddl-auto=update
-# This helps you see what's happening in the logs
 spring.jpa.show-sql=true
 
-# Force Eureka to use 'localhost' instead of the computer's name/IP
+# Eureka Instance Config
 eureka.instance.hostname=localhost
 eureka.instance.prefer-ip-address=true