Securing Spring Cloud Gateway: A Practical Example

Why Secure a Gateway?

Spring Cloud Gateway is the entry point for microservices. Exposing it without controls opens every downstream service to attack, data leakage, and abuse. Security layers such as authentication, authorization, and traffic shaping keep services safe and compliant.

JWT Authentication with Keycloak

Integrate Keycloak as an OIDC provider and protect routes with a JWT filter.

Dependencies

Add to pom.xml:

<dependency> <groupId>org.springframework.cloud</groupId> <artifactId>spring-cloud-starter-gateway</artifactId></dependency><dependency> <groupId>org.springframework.security</groupId> <artifactId>spring-security-oauth2-resource-server</artifactId></dependency>

Configuration

In application.yml:

spring: security: oauth2: resourceserver: jwt: issuer-uri: https://keycloak.example.com/auth/realms/myrealm jwk-set-uri: https://keycloak.example.com/auth/realms/myrealm/protocol/openid-connect/certs

Define a route that requires a valid token:

spring.cloud.gateway.routes[0]: id: secured-service uri: lb://MY-SERVICE predicates:

• Path=/api/**

filters:

• TokenRelay

metadata: jwt-auth: true

Rate Limiting with Redis

Prevent abuse by limiting requests per IP or user.

Dependencies

Add:

<dependency> <groupId>org.springframework.cloud</groupId> <artifactId>spring-cloud-starter-gateway-ratelimit</artifactId></dependency><dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-data-redis</artifactId></dependency>

Configuration

Configure Redis and rate limiter:

spring: redis: host: redis port: 6379 cloud: gateway: filter:

• name: RequestRateLimiter

args: redis-rate-limiter.replenishRate: 5 redis-rate-limiter.burstCapacity: 10

CORS and CSRF Protection

Allow trusted origins and disable CSRF for stateless APIs.

Example

@Bean public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) { http.csrf().disable() .cors().configurationSource(request -> { CorsConfiguration config = new CorsConfiguration(); config.setAllowedOrigins(Arrays.asList("https://app.example.com")); config.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE")); config.setAllowedHeaders(Arrays.asList("Authorization", "Content-Type")); return config; }) .and().oauth2ResourceServer().jwt(); return http.build(); }

Monitoring and Logging

Enable access logs and integrate with Prometheus:

spring.cloud.gateway.globalFilters[0]: name: RequestLog args: logLevel: INFO

Expose metrics:

management.endpoints.web.exposure.include: health,info,prometheus

Putting It All Together

Combine the snippets in a single GatewayApplication class, test with Postman using a Keycloak token, and observe rate limits in action. The gateway now authenticates, authorizes, limits traffic, and enforces CORS, providing a robust shield for microservices.