I hope this question isn’t a bit low level, however I’m seeking clarification around what I’ve implemented in terms of design and best practises.

Using Spring Cloud, along with Zuul I have a distributed system. Users authenticate with a third party service (Auth0) via the web client which returns them a JWT.

The web client then uses the access token to authenticate in each request, sending it downstream from Zuul using a filter. The microservice then validates the token again making sure it’s not been tampered with.

There is so much information around the internet that it’s hard to work out if this is the correct approach, or if I should be using “internal” tokens, or even Redis with sessions once the token is validated in the gateway to authenticate with the services downstream.

To enable downstream use of my token I’m using a Zuul filter which looks like: @Component public class TokenRelayFilter extends ZuulFilter {

@Override public Object run() {     RequestContext ctx = RequestContext.getCurrentContext();     Set<String> headers = (Set<String>) ctx.get("ignoredHeaders");     headers.remove("authorization");     return null; }  @Override public boolean shouldFilter() {     return true; }  @Override public String filterType() {     return "pre"; }  @Override public int filterOrder() {     return 10000; } 

}

And in each microservice I simple configure a SecurityConfig like

@Configuration @EnableWebSecurity @Order(1) public class SecurityConfig extends WebSecurityConfigurerAdapter {      @Value(value = "$  {auth0.audience}")     private String audience;      @Value(value = "$  {auth0.issuer}")     private String issuer;      @Override     protected void configure(HttpSecurity httpSecurity) throws Exception {         JwtWebSecurityConfigurer                 .forRS256(audience, issuer)                 .configure(httpSecurity)                 .csrf().disable()                 .authorizeRequests()                 .anyRequest().authenticated();     } } 

Which checks the token against the third party provider.

Note: JwtWebSecurityConfigurer in this case is using com.auth0:auth0-spring-security-api:1.0.0-rc.3 to validate the token.

Question: Is this okay or is there a more “proper” way that this should be done in today’s world of stateless, highly distributed microsystems?