Getting Access Denied when calling API from one service to another using Feign client

Question

We have two microservices deployed on AWS EKS into the same namespace. We are trying to call the API of one service into another service.

If we try to call API from POD using curl it is working, If we use Web Client also in code to call the API then it is working but when we use Feign Client it is not working.

Passing only authorization and content-type headers in all the implementations.

Below is the error:

<FONT face=\"Helvetica\">
Your system policy has denied access to the requested URL.
</FONT>
<FONT face=\"Helvetica\">
Transaction ID: dcff724f84f5aca8-00000000eadbc942-0000000065e5d403
</FONT>
<FONT face=\"Helvetica\" SIZE=2>
For assistance, contact your network support team.
</FONT>

feign.FeignException$Forbidden: [403 Forbidden] during [POST] to [http://test-service:8080/process/7336f66a-7ab5-4a23-23ed-d7cde05a4eda]
<TITLE>Access Denied</TITLE>

Using spring-boot:3.1.6 spring-cloud-starter-openfeign:4.0.2

I am trying to call one service API from another service that is deployed in the same namespace of AWS EKS.

Using a web client I can successfully call the API but getting 403 while using Feign client. Passed the same headers in both implementations.

Answer 1

Your feign cant send your Authorization header to next api you must use feign interceptor in your code like this

@Component
  public class FeignRequestInterceptor implements 
  RequestInterceptor 
{

    @Override
    public void apply(RequestTemplate template) {
        final RequestAttributes requestAttributes = 
        RequestContextHolder.getRequestAttributes();
        if (requestAttributes != null) {
        final HttpServletRequest httpServletRequest = 
        ((ServletRequestAttributes) 
          requestAttributes).getRequest();
        template.header(HttpHeaders.AUTHORIZATION, 
        httpServletRequest.getHeader(HttpHeaders.AUTHORIZATION));
    }
}

Add this class in your projects configuration package and it will automatically transfer Authorization header to the next api