# Keycloak & Spring Cloud Gateway

**URL:** <https://forum.keycloak.org/t/keycloak-spring-cloud-gateway/1745>\
**Category:** Securing applications\
**Created:** [March 18, 2020, 11:10pm UTC](https://forum.keycloak.org/t/keycloak-spring-cloud-gateway/1745 "2020-03-18T23:10:02Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![urosbelov](https://avatars.discourse-cdn.com/v4/letter/u/22d042/32.png) [@urosbelov](https://forum.keycloak.org/u/urosbelov)\
**Post date:** [March 18, 2020, 11:10pm UTC](https://forum.keycloak.org/t/keycloak-spring-cloud-gateway/1745/1 "2020-03-18T23:10:03Z")

</div>

Securing Microservices with Keycloak and Spring Cloud Gateway…  
Can somebody share their story, best practices and trick before starting.

My goal is to validate every request in gateway and to pass it further to the microservices if everything is ok.

Today I tried following this tutorial:

[https://blog.jdriven.com/2019/11/spring-cloud-gateway-with-openid-connect-and-token-relay/](https://blog.jdriven.com/2019/11/spring-cloud-gateway-with-openid-connect-and-token-relay/)

When send request with Postman everything is good, but when send GET request from React app I got preflight cors error.

 ![Screen Shot 2020-03-19 at 00.14.27](https://global.discourse-cdn.com/free1/uploads/keycloak/original/1X/0e985fd050709d2d14d1c3943b63d2d5c32e3045.png)

 ![Screen Shot 2020-03-19 at 00.12.04](https://global.discourse-cdn.com/free1/uploads/keycloak/original/1X/4fbc6d3d3467c70cce3205e4aa2a80ed4095ca44.png)

 ![Screen Shot 2020-03-19 at 00.22.57](https://global.discourse-cdn.com/free1/uploads/keycloak/original/1X/0be8dec0e5d72cb4e6efacd661ad58527a08e5aa.png)

192.168.0.101:3000 is React App  
192.168.0.101:4000 Spring Gateway  
192.168.0.101:4001 Resource Stores server

---

<div class="post-metadata">

**Author:** ![sushantac](https://avatars.discourse-cdn.com/v4/letter/s/ecae2f/32.png) [@sushantac](https://forum.keycloak.org/u/sushantac)\
**Post date:** [April 4, 2020, 5:28am UTC](https://forum.keycloak.org/t/keycloak-spring-cloud-gateway/1745/2 "2020-04-04T05:28:29Z")

</div>

(If not already done) Try adding Web Origin in you client setting in Keycloak realm. See in image below.

In Spring Cloud Gateway application.properties, you can also specify allowedOrigins. I was facing similar (not exact) pre-flight request issue and got over it by adding authorization in allowedHeaders and OPTIONS in allowedMethods -

 ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/1X/38ce75c36adcc6d1d819ab7c27cf3dd69bafc9a9.png)

I faced pre-flight request error when I started passing Authorization header in request. These steps helped me get over it.

---

<div class="post-metadata">

**Author:** ![detomarco](https://avatars.discourse-cdn.com/v4/letter/d/7993a0/32.png) [@detomarco](https://forum.keycloak.org/u/detomarco)\
**Post date:** [April 13, 2020, 1:11pm UTC](https://forum.keycloak.org/t/keycloak-spring-cloud-gateway/1745/3 "2020-04-13T13:11:47Z")

</div>

I tried to follow the same tutorial but it does not work for me even with Postman.  
Can you tell me how did you get the token and how do you perform a resource request with token?

---

<div class="post-metadata">

**Author:** ![rusli1621](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rusli1621](https://forum.keycloak.org/u/rusli1621)\
**Post date:** [May 31, 2020, 10:41am UTC](https://forum.keycloak.org/t/keycloak-spring-cloud-gateway/1745/4 "2020-05-31T10:41:04Z")

</div>

I tried the following: [https://medium.com/@bcarunmail/securing-rest-api-using-keycloak-and-spring-oauth2-6ddf3a1efcc2](https://medium.com/@bcarunmail/securing-rest-api-using-keycloak-and-spring-oauth2-6ddf3a1efcc2)

#Gateway  
I also get to the keycloak login screen by using the following in the application.properties:  
spring.cloud.gateway.routes[1].id=keycloak  
spring.cloud.gateway.routes[1].uri=http://localhost:8180/  
spring.cloud.gateway.routes[1].predicates[0].name=Path  
spring.cloud.gateway.routes[1].predicates[0].args[pattern]=/auth/\*\*

#Keycloak  
spring.security.oauth2.client.registration.keycloak.client-id=gateway-app  
spring.security.oauth2.client.registration.keycloak.client-secret=f52b34e1-3cae-4de7-83ae-2d795e3b72d7  
spring.security.oauth2.client.registration.keycloak.clientName=gateway-app  
spring.security.oauth2.client.registration.keycloak.authorization-grant-type=authorization\_code  
spring.security.oauth2.client.registration.keycloak.redirectUri=http://localhost/personprocess/  
spring.security.oauth2.client.provider.keycloak.authorization-uri=http://localhost:8180/auth/realms/gateway-realm/protocol/openid-connect/auth  
spring.security.oauth2.client.provider.keycloak.token-uri=http://localhost:8180/auth/realms/gateway-realm/protocol/openid-connect/token  
spring.security.oauth2.client.provider.keycloak.user-info-uri=http://localhost:8180/auth/realms/gateway-realm/protocol/openid-connect/userinfo  
spring.security.oauth2.client.provider.keycloak.jwk-set-uri=http://localhost:8180/auth/realms/gateway-realm/protocol/openid-connect/certs

POM.xml:

```
	<!-- gateway -->
	<dependency>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-starter-actuator</artifactId>
	</dependency>
    <dependency>
        <groupId>org.springframework.cloud</groupId>
        <artifactId>spring-cloud-starter-config</artifactId>
    </dependency>		
	<dependency>
		<groupId>org.springframework.cloud</groupId>
		<artifactId>spring-cloud-starter-gateway</artifactId>
	</dependency>
	<dependency>
		<groupId>org.springframework.cloud</groupId>
		<artifactId>spring-cloud-starter-netflix-eureka-client</artifactId>
	</dependency>

	<!-- using CircuitBreaker -->
	<dependency>
	    <groupId>org.springframework.cloud</groupId>
	    <artifactId>spring-cloud-starter-circuitbreaker-reactor-resilience4j</artifactId>
	</dependency>
	<!-- end of CircuitBreaker -->

	<!-- oauth2 keycloak -->
	<dependency>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-starter-webflux</artifactId>
	</dependency>
	<dependency>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-starter-oauth2-client</artifactId>
	</dependency>
	<dependency>
		<groupId>org.springframework.cloud</groupId>
		<artifactId>spring-cloud-starter-security</artifactId>
	</dependency>

```

Got to login using the realm’s username and password. After login it redirects to: [http://localhost/oauth2/authorization/keycloak](http://localhost/oauth2/authorization/keycloak)

Not sure what’s happening. I’m still working on it. If there’s any pointer, please share.

Thanks.

---

<div class="post-metadata">

**Author:** ![rcbandit](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/rcbandit/32/7189_2.png) [@rcbandit](https://forum.keycloak.org/u/rcbandit)\
**Post date:** [June 4, 2023, 4:02pm UTC](https://forum.keycloak.org/t/keycloak-spring-cloud-gateway/1745/5 "2023-06-04T16:02:20Z")

</div>

Hello guys, I have the same issue. Can you share some solution, please?