Relay tokens between microservices with webclient - spring-boot

Question

I have two microservices, lets name them A and B, behind a Spring Cloud Gateway. There is also an OAuthServer. When a users send a request to service A they have first to get a JWT token from the oAuthServer using the password flow.
The caveat is that service A needs to communicate with service B but for that it needs an access token. The idea is to use the JWT provided by the user when accessing service A by relaying it to service B thus making the request.
In previous versions of Spring Boot I would use OAuth2RestTemplate but now I need to use Webclient.
What I have done is to create a filter to extract the Bearer token from the incoming request in service A and then store it in a singleton class and add it manually to the outbound call.
#Component
public class JWTAuthorizationFilter extends OncePerRequestFilter {
private static final Logger log = LoggerFactory.getLogger(JWTAuthorizationFilter.class);
private final String HEADER = "Authorization";
private final String PREFIX = "Bearer ";
private TokenStore tokenStore;
#Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
throws ServletException, IOException {
if (checkJWTToken(request, response)) {
String token = extractToken(request);
if (token != null) {
log.info("*****RECEIVED REQUEST WITH TOKEN {}. ", token);
log.info("***** Will store it for future requests.");
tokenStore = TokenStore.getInstance();
tokenStore.setToken(token);
// setUpSpringAuthentication(token);
} else {
SecurityContextHolder.clearContext();
}
}
chain.doFilter(request, response);
}
private String extractToken(HttpServletRequest request) {
String jwtToken = request.getHeader(HEADER).replace(PREFIX, "");
return jwtToken;
}
private boolean checkJWTToken(HttpServletRequest request, HttpServletResponse res) {
String authenticationHeader = request.getHeader(HEADER);
if (authenticationHeader == null || !authenticationHeader.startsWith(PREFIX))
return false;
return true;
}
The TokenStore
public class TokenStore {
private static TokenStore instance;
private String token;
private TokenStore() {
}
public static synchronized TokenStore getInstance() {
if (instance == null) {
instance = new TokenStore();
}
return instance;
}
public String getToken() {
return token;
}
public synchronized void setToken(String token) {
this.token = token;
}
}
And finally the web client:
#Bean
#LoadBalanced
#Profile("!default")
public WebClient.Builder loadBalancedWebClientBuilder() {
final WebClient.Builder builder = WebClient.builder();
return builder;
}
Using it:
Mono<Map<Long, DrawDTO>> mono = getWebClient().get().uri(url)
.header("Authorization", "Bearer " + tokenStore.getToken()).retrieve().bodyToFlux(DTO.class)
.map(d -> Tuples.of(Long.parseLong(d.getUniqueId()), d))
.collectMap(tuple -> tuple.getT1(), tuple -> tuple.getT2()).log()
.onErrorMap(WebClientResponseException.class, ex -> handleException(ex)).timeout(Duration.ofSeconds(5));
However, I am pretty sure that the above is a mistake. TokenStore being a singleton if two requests come from users X and Y at the same time the second filter invocation will override the token of the first. So essentially service A will use user's Y token to complete the request of user X. So in case user's X access level is lower than Y this is a security issue.
Am I wrong about the above? If yes what can I do to fix it?
One solution I found was to use client credentials for intra-service communications but I am not 100% sure how to do it with Spring Boot 2.2.6 and Spring Security 5.
Is there a correct way to do what I initially intended?