Shulou(Shulou.com)06/02 Report--

This article mainly explains "what is the secure connection mode of Spring Cloud service". The content of the article is simple and clear, and it is easy to learn and understand. Please follow the editor's train of thought to study and learn "what is the secure connection mode of Spring Cloud service".

Spring Cloud service secure connection

Spring Cloud can add HTTP Basic authentication to increase the security of service connections.

1. Join the security initiator

Add Spring Boot's security initiator to the maven configuration file.

Org.springframework.boot spring-boot-starter-security

In this way, the security of the service connection is enabled, and the system defaults to generate a user name "user" and a random password, which will be printed in the log when the service starts.

2. Custom user name and password

Random passwords don't make any practical sense, we need a fixed connection username and password.

Just add the following configuration to the application configuration file.

Security: user: name: admin password: admin123456

In this way, a user name and password will be required when connecting to the service after configuration, and a 401 error will be returned if authentication fails.

{"timestamp": 1502689874556, "status": 401, "error": "Unauthorized", "message": "Bad credentials", "path": "/ test/save"} 3, secure connection

1. Secure connection to the registry

Username:password@ipaddress

2. Feign declarative service secure connection

@ FeignClient (name = "SERVICE", configuration = FeignAuthConfig.class) public interface OrderService extends OrderAPI {} @ Configurationpublic class FeignAuthConfig {@ Bean public BasicAuthRequestInterceptor basicAuthRequestInterceptor () {return new BasicAuthRequestInterceptor ("admin", "admin123456");}} Spring Cloud Micro Service Security

JWT-the first station of network security

CORS-Cross-domain Security solution

Spring Security-Service Security Guard

1. Introduction of JWT

Authentication of JWT:

1. Full name of JWT-JSON Web Token

2. JWT is mainly used for identity authentication and information encryption.

3. JWT is a simple and effective security authentication method.

Second, the advanced characteristics of JWT

1. JWT can carry data for transmission, which is convenient for backend to use.

2. JWT can sign the transmitted data to increase security

III. Composition of JWT

1. Header: stores information about signature algorithms

2. Payload: store information

3. Signature:header + payload + secret key to do hash356 encryption

4. Configure the logic of request filtering in the gateway module

1. Verify the validity of Token

2. Parse out the payload in JWT

3. Is it necessary to check the visa?

4. Judge whether userId is effective or not

5. CORS (cross-domain resource sharing)

1. Cross-domain resource sharing: Cross-origin, resource sharing

2. Domain: cross-domain when one of the protocols, domain names and ports of a request is different.

3. Configure request filtering of cross-domain resources at the gateway, configure the way of resource sharing and the target party.

4. Defect: if the cross-domain policy is insufficient, you need to modify the code and redeploy (costly)-> Nginx (optional)

VI. Eureka Server Security issues (Spring Security)

1. Spring Cloud can use Spring Security for authentication by default

2. Eureka Server can use Spring Security to establish a secure connection

3. The new version of Spring Cloud will enable CSRF defense by default (can be turned off), which will cause some errors.

4. Step: add dependency package and configure user name and password of registry

Thank you for your reading, the above is the content of "what is the secure connection mode of Spring Cloud services". After the study of this article, I believe you have a deeper understanding of what the secure connection mode of Spring Cloud services is, and the specific use needs to be verified in practice. Here is, the editor will push for you more related knowledge points of the article, welcome to follow!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.