<commit_before>---
title: API Gateway Security - OAuth2
author: Mateusz512
keywords: tutorial
date: 2020-01-17
layout: tutorial
knotxVersions:
  - 2.0.0
---
# Overview

In this tutorial, we will take a look on how to secure an API gateway.

This tutorial is based on the code we implemented in [Getting Started with Docker tutorial](/tutorials/getting-started-with-docker/). If you didn't complete the tutorial, we highly encourage you to do so.

# Prerequisites

- JDK 8
- Docker (not required, you can use Stack distribution as well)
- [`curl`](https://curl.haxx.se/download.html)
- Google account

To keep things simple, we'll start from the code already implemented in the tutorial mentioned before, which is available [here](https://github.com/Knotx/knotx-example-project/tree/master/distribution/getting-started).

Let's quickly recap on the things we'll reuse here.

We've already implemented the `HelloWorldHandlerFactory` which simply prints the configured message to the HTTP response. All the details are available [here](/tutorials/getting-started-with-knotx-stack/2_0/) in section _API implementation: creating new Handler_.

In this tutorial we'll make sure that this handler is accessible only for authenticated users.

# OAuth2 & Google Account

We'll use our own Google Account and OAuth2 to authorize a request to Google API to print a personalized hello message!

## OAuth2 flow

[OAuth2](https://auth0.com/docs/api-auth/which-oauth-flow-to-use) is all about flows.
We'll use the most common one - [Authorization Code Grant](https://oauth.net/2/grant-types/authorization-code/).

The diagram below shows the flow we'll implement:

![OAuth 2 flow](/img/blog/api-gateway-security/security-oauth2-flow.png)

1. The user accesses `/api/secure/login` in the browser.
2. Server responds with a redirect to Google consent screen, providing the application id to the request.
3. The user logs in to his Google Account and allows our application to access his user details.
4. The consent screen redirects the browser to `/api/secure/oauth2` with a special token called [authorization code](https://www.oauth.com/oauth2-servers/access-tokens/authorization-code-request/) passed as a `code` query parameter.
5. The server is exchanging the authorization code for user's access token. The request must also contain application's client secret.
6. Having the user's access token, the server can access API endpoints on behalf of the user. In our case we'll invoke an endpoint that will provide us with basic user info.
7. Having the user info, we'll produce the final response with a personalized *hello* message.

## Google Account Setup

Now let's create a new application in Google API.
<commit_msg>#77 remove hello-handler mention<commit_after>---
title: API Gateway Security - OAuth2
author: Mateusz512
keywords: tutorial
date: 2020-01-17
layout: tutorial
knotxVersions:
  - 2.0.0
---
# Overview

In this tutorial, we will take a look on how to secure an API gateway.

This tutorial is based on the code we implemented in [Getting Started with Docker tutorial](/tutorials/getting-started-with-docker/). If you didn't complete the tutorial, we highly encourage you to do so.

# Prerequisites

- JDK 8
- Docker (not required, you can use Stack distribution as well)
- [`curl`](https://curl.haxx.se/download.html)
- Google account

To keep things simple, we'll start from the code already implemented in the tutorial mentioned before, which is available [here](https://github.com/Knotx/knotx-example-project/tree/master/distribution/getting-started).

# OAuth2 & Google Account

We'll use our own Google Account and OAuth2 to authorize a request to Google API to print a personalized hello message!

## OAuth2 flow

[OAuth2](https://auth0.com/docs/api-auth/which-oauth-flow-to-use) is all about flows.
We'll use the most common one - [Authorization Code Grant](https://oauth.net/2/grant-types/authorization-code/).

The diagram below shows the flow we'll implement:

![OAuth 2 flow](/img/blog/api-gateway-security/security-oauth2-flow.png)

1. The user accesses `/api/secure/login` in the browser.
2. Server responds with a redirect to Google consent screen, providing the application id to the request.
3. The user logs in to his Google Account and allows our application to access his user details.
4. The consent screen redirects the browser to `/api/secure/oauth2` with a special token called [authorization code](https://www.oauth.com/oauth2-servers/access-tokens/authorization-code-request/) passed as a `code` query parameter.
5. The server is exchanging the authorization code for user's access token. The request must also contain application's client secret.
6. Having the user's access token, the server can access API endpoints on behalf of the user. In our case we'll invoke an endpoint that will provide us with basic user info.
7. Having the user info, we'll produce the final response with a personalized *hello* message.

## Google Account Setup

Now let's create a new application in Google API.

{'fraction_non_alphanumeric': 0.08261994823810472, 'fraction_numerical': 0.013935894883535735, 'mean_word_length': 4.367521367521367, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 10, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5277765', 'n_tokens_mistral': 1467, 'n_tokens_neox': 1359, 'n_words': 637}