rapter1990/springbootmicroserviceswithsecurity

Purpose and topology

A Java 21/Spring Boot 3 microservice example providing JWT authentication and role-based product access. It is a multi-module-by-directory repository: each service is independently buildable/deployable via Maven and Docker. Runtime order is Eureka → API Gateway → auth, user, and product services.

Service entry points

Each deployable has its own Spring Boot main class and configuration:

• Discovery: eurekaserver/src/main/java/com/springbootmicroservices/eurekaserver/EurekaserverApplication.java

• Edge gateway: apigateway/src/main/java/com/springbootmicroservices/apigateway/ApigatewayApplication.java

• Authentication façade: authservice/src/main/java/com/springbootmicroservices/authservice/AuthserviceApplication.java

• Identity/token authority: userservice/src/main/java/com/springbootmicroservices/userservice/UserserviceApplication.java

• Product API: productservice/src/main/java/com/springbootmicroservices/productservice/ProductserviceApplication.java

Service registration, ports, routes, and security properties are service-local in each src/main/resources/application.yml.

Discovery and edge boundary

Eureka is the service-discovery control plane, allowing gateway and internal clients to resolve service instances rather than hard-code addresses. The API Gateway is the public routing and first authentication boundary; its JWT filter and routing configuration are:

• apigateway/src/main/java/com/springbootmicroservices/apigateway/config/GatewayConfig.java

• apigateway/src/main/java/com/springbootmicroservices/apigateway/filter/JwtAuthenticationFilter.java

• apigateway/src/main/java/com/springbootmicroservices/apigateway/client/UserServiceClient.java

Client traffic reaches gateway routes, which authenticate/validate bearer-token context and forward to authentication or product endpoints.

Authentication and identity flow

authservice exposes register, login, refresh, and logout APIs through AuthController, but delegates user/account-oriented work through its user-service client. Its service layer separates registration, credentials login, token refresh, and logout:

• authservice/src/main/java/com/springbootmicroservices/authservice/controller/AuthController.java

• authservice/src/main/java/com/springbootmicroservices/authservice/client/UserServiceClient.java

• authservice/src/main/java/com/springbootmicroservices/authservice/service/impl/UserLoginServiceImpl.java

userservice is the persistence-owning identity and token service. It stores users and invalidated tokens, issues/refreshes tokens, and enforces token invalidation:

• userservice/src/main/java/com/springbootmicroservices/userservice/controller/UserController.java

• userservice/src/main/java/com/springbootmicroservices/userservice/service/impl/TokenServiceImpl.java

• userservice/src/main/java/com/springbootmicroservices/userservice/repository/InvalidTokenRepository.java

This boundary means authentication orchestration is separate from authoritative user and revoked-token state.

Authorization model

JWT bearer authentication is independently enforced at gateway and protected downstream services. User and product services each provide custom bearer filters, Spring Security configuration, authentication-entry-point handling, and JWT key/configuration handling:

• userservice/src/main/java/com/springbootmicroservices/userservice/filter/CustomBearerTokenAuthenticationFilter.java

• productservice/src/main/java/com/springbootmicroservices/productservice/filter/CustomBearerTokenAuthenticationFilter.java

• productservice/src/main/java/com/springbootmicroservices/productservice/config/TokenConfigurationParameter.java

The stated policy is role-based: Admin can create/read/update/delete products; User can only read. Product service also has a UserServiceClient, indicating an interservice identity/authorization dependency.

Product domain and persistence

productservice owns product CRUD, pagination, domain/entity mapping, repository access, and API exception translation:

• productservice/src/main/java/com/springbootmicroservices/productservice/controller/ProductController.java

• productservice/src/main/java/com/springbootmicroservices/productservice/service/impl/ProductReadServiceImpl.java

• productservice/src/main/java/com/springbootmicroservices/productservice/repository/ProductRepository.java

Request flow is controller → role/security filter → focused CRUD service → repository → ProductEntity, with DTO/domain mappers at the API/persistence boundary. User and product persistence schemas are initialized through init.sql.

Deployment and external infrastructure

Docker Compose orchestrates the five containers plus database dependencies/configuration: docker-compose.yml; each service supplies a multi-stage image build via its Dockerfile. Database credentials are injected through DATABASE_USERNAME and DATABASE_PASSWORD. GitHub Actions maintains separate CI/CD pipelines per deployable service, e.g. .github/workflows/product-service-ci-cd.yml and .github/workflows/api-gateway-ci-cd.yml. Images are published to Docker Hub per the README.