API Gateway with Spring Cloud Gateway

spring:
  cloud:
    gateway:
      default-filters:
        - AddResponseHeader=X-Gateway, acme-edge
        - RemoveRequestHeader=X-Internal-Trusted   # strip client attempts to forge it
      routes:
        - id: orders
          uri: lb://order-service
          predicates:
            - Path=/api/v1/orders/**
          filters:
            - StripPrefix=2
            - name: CircuitBreaker
              args:
                name: ordersCircuitBreaker
                fallbackUri: forward:/fallback/orders
            - name: RequestRateLimiter
              args:
                redis-rate-limiter.replenishRate: 100
                redis-rate-limiter.burstCapacity: 200
                redis-rate-limiter.requestedTokens: 1
                key-resolver: '#{@userKeyResolver}'
            - name: Retry
              args:
                retries: 2
                # Only idempotent methods. Retrying a POST after a timeout can
                # create a duplicate order.
                methods: GET
                series: SERVER_ERROR
                backoff:
                  firstBackoff: 100ms
                  maxBackoff: 1s
                  factor: 2
 
        - id: catalogue
          uri: lb://catalogue-service
          predicates:
            - Path=/api/v1/catalogue/**
            - Method=GET
          filters:
            - StripPrefix=2
            - AddResponseHeader=Cache-Control, "public, max-age=300"
 
        - id: partner
          uri: lb://partner-api
          predicates:
            - Host=partner.acme.com
            - Header=X-Partner-Key, .+

@Component
public class CorrelationIdGlobalFilter implements GlobalFilter, Ordered {
 
    private static final String HEADER = "X-Correlation-Id";
 
    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        String id = Optional.ofNullable(exchange.getRequest().getHeaders().getFirst(HEADER))
                            .filter(StringUtils::hasText)
                            .orElseGet(() -> UUID.randomUUID().toString());
 
        ServerWebExchange mutated = exchange.mutate()
                .request(r -> r.header(HEADER, id))
                .build();
 
        mutated.getResponse().getHeaders().set(HEADER, id);
 
        // Reactive: there is no ThreadLocal to write to. Put it in the Reactor
        // context, and let the logging bridge pick it up.
        return chain.filter(mutated)
                .contextWrite(Context.of(HEADER, id));
    }
 
    @Override
    public int getOrder() {
        return Ordered.HIGHEST_PRECEDENCE;   // first, so every later filter can log it
    }
}

@Component
public class AuthenticationGlobalFilter implements GlobalFilter, Ordered {
 
    private final ReactiveJwtDecoder decoder;
    private final List<PathPattern> publicPaths;
 
    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        var request = exchange.getRequest();
 
        if (publicPaths.stream().anyMatch(p -> p.matches(request.getPath().pathWithinApplication()))) {
            return chain.filter(exchange);
        }
 
        String header = request.getHeaders().getFirst(HttpHeaders.AUTHORIZATION);
        if (header == null || !header.startsWith("Bearer ")) {
            return unauthorized(exchange, "missing bearer token");
        }
 
        return decoder.decode(header.substring(7))
                .flatMap(jwt -> {
                    // Forward identity downstream so services do not re-decode.
                    // They still validate the token themselves — this is a
                    // convenience, never a trust boundary.
                    var mutated = exchange.mutate()
                            .request(r -> r
                                    .header("X-User-Id", jwt.getSubject())
                                    .header("X-User-Scopes", String.join(" ", scopesOf(jwt))))
                            .build();
                    return chain.filter(mutated);
                })
                .onErrorResume(JwtException.class,
                        ex -> unauthorized(exchange, "invalid token"));
    }
 
    @Override
    public int getOrder() { return -100; }
}

@Bean
KeyResolver userKeyResolver() {
    return exchange -> Mono.justOrEmpty(exchange.getRequest().getHeaders().getFirst("X-User-Id"))
            // Fall back to IP for unauthenticated traffic, which is exactly
            // where limiting matters most — login and registration.
            .switchIfEmpty(Mono.justOrEmpty(
                    exchange.getRequest().getRemoteAddress())
                    .map(addr -> addr.getAddress().getHostAddress()))
            .defaultIfEmpty("anonymous");
}

@RestController
public class FallbackController {
 
    @RequestMapping("/fallback/orders")
    public ResponseEntity<ProblemDetail> ordersFallback() {
        var problem = ProblemDetail.forStatusAndDetail(
                HttpStatus.SERVICE_UNAVAILABLE,
                "The order service is temporarily unavailable. Please retry shortly.");
        problem.setType(URI.create("https://api.acme.com/errors/service-unavailable"));
        problem.setTitle("Service unavailable");
        return ResponseEntity.status(HttpStatus.SERVICE_UNAVAILABLE)
                .header(HttpHeaders.RETRY_AFTER, "30")
                .body(problem);
    }
}