Securing Microservices with Spring Cloud Security
summary
Covers concrete recipes: config files and commits that wire UAA to Spring Cloud Security, use of signed JWT access tokens fetched from a JWK URI, and an OAuth2 single‑sign‑on flow with OAuth2RestTemplate relaying tokens to two UI apps and two resource APIs (Freddy’s Barbecue Joint demo). Tests run as full web integrations catch SSL redirect and audience/scope bugs. Shows JWT payloads, tradeoffs (stateless verification vs no instant revocation), Zuul token relay/encryption examples, and working local + PWS deployments.
AI-written summary · about
chapters (15)
- 0:00Introduction and speaker background
- 2:37Security in monolithic vs microservices
- 5:27Microservices security challenges
- 7:11API gateway perimeter security
- 8:19Centralized authentication store issues
- 9:45OAuth 2 and OpenID Connect overview
- 16:10Authorization code flow explained
- 22:51Spring Cloud Security features
- 25:24UAA introduction and JWT tokens
- 28:58Demo setup and single sign-on
- 38:32Freddy's Barbecue Joint project
- 46:10Adding single sign-on to customer UI
- 54:13Testing security configurations
- 1:01:09Creating resource server with Spring Data
- 1:18:52Final demo and Q&A
related talks
56mSecured REST Microservices with Spring Cloud
46mImplementing Microservices Security Patterns & Protocols with Spring Security
51mSecuring applications with OAuth2 and OpenID Connect using SpringSecurit
50mArchitectural Patterns for Spring Security You Wish Your Tech Lead Knew
01h 31mSecurity for Microservices with Spring and OAuth2
31mSecure-by-Default Spring Apps: Zero Trust, OAuth2, and Runtime Policies
01h 26mSecuring Rest-ful Web Services with OAuth2
43mIdentity crisis: bending Spring Security to your advanced use-cases