Secure Legacy Apps with Spring Cloud Gateway

spring:
  cloud:
    gateway:
      routes:
      - id: servlet-app
        uri: http://localhost:8000 (1)
        predicates:
        - Path=/profile,/ (2)
        filters:
        - TokenRelay= (3)

package com.okta.example;

import com.okta.jwt.AccessTokenVerifier;
import com.okta.jwt.Jwt;
import com.okta.jwt.JwtVerificationException;
import com.okta.jwt.JwtVerifiers;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

@WebFilter(urlPatterns = "*")
public class BearerTokenFilter implements Filter {

    public static final String ACCESS_TOKEN = "jwtAccessToken";
    private static final String ISSUER_KEY = "okta.oauth2.issuer";

    private AccessTokenVerifier tokenVerifier;

    public void init(FilterConfig filterConfig) throws ServletException {
        String issuer = System.getProperty(ISSUER_KEY, filterConfig.getInitParameter(ISSUER_KEY)); (1)
        tokenVerifier = JwtVerifiers.accessTokenVerifierBuilder() (2)
                .setIssuer(issuer)
                .build();
    }

    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {

        HttpServletRequest request = (HttpServletRequest) servletRequest;
        HttpServletResponse response = (HttpServletResponse) servletResponse;
        String authHeader = request.getHeader("Authorization"); (3)

        if (authHeader == null || !authHeader.startsWith("Bearer ")) { (4)
            request.getServletContext().log("Missing or invalid 'Authorization' header");
            respondWith401(response);
            return;
        }

        String token = authHeader.replaceFirst("^Bearer ", ""); (5)

        try {
            Jwt jwtAccessToken = tokenVerifier.decode(token); (6)
            // invalid access tokens will throw an exception
            // add the access token as a request attribute
            request.setAttribute(ACCESS_TOKEN, jwtAccessToken); (7)
            filterChain.doFilter(request, response); (8)
        } catch (JwtVerificationException e) {
            request.getServletContext().log("Failed to parse access token", e);
            respondWith401(response);
        }
    }

    private void respondWith401(HttpServletResponse response) throws IOException { (9)
        response.setStatus(401);
        response.setHeader("WWW-Authenticate","Bearer");
        response.getWriter().write("Authentication required");
    }

    public void destroy() {
        tokenVerifier = null;
    }
}

@Override
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

    Jwt accessToken = (Jwt) request.getAttribute(BearerTokenFilter.ACCESS_TOKEN); (1)
    request.setAttribute("email", accessToken.getClaims().get("sub")); (2)
    request.setAttribute("userAttributes", accessToken.getClaims()); (3)

    request.getRequestDispatcher("/WEB-INF/user-profile.jsp").forward(request, response);
}