mtbarta
commented
6 years ago https://github.com/gambol99/keycloak-proxy this is a golang proxy for keycloak/oidc.
There are really two options here:
- correctly implement authentication inside of the gateway.
- add in a proxy service between traefik and the gateway.
The benefits of 1 would be fewer services to maintain and orchestrate. However, the implementation time would be longer. I would also have additional control over what happens during token validation.
option 2 would provide separation of concerns, and the gateway would only need to know about graphQL and routing to backend services.
The gateway has basic functionality for extracting data from a bearer token, but has no logic for dealing with expired tokens. Given an expired token, the gateway will reject the call.
This becomes annoying for the user, since the only way to fix this currently is to login again. The frontend should be updating the token, although this may not be working as intended.
A more robust solution to explore is to use keycloak's proxy service in between traefik and the gateway. This would allow better token handling and a way to have a dev environment without authentication. The downside is that this is adding another hop to every request.