How to use Spring Security with load balancer?

Question

I am new at loadBalancing so please I need help and thats what i did : i built 2 services as 2 apps (A,B) I used spring security on both of them (both of them are restfull api , they have theymleaf and full frontEnd pages ), then i had made another app as spring cloud loadbalancer . when i send a request , it go from loadbalancer app to one of the 2 services but the problem is when iam not authenticated the response will be empty , it wont take me to the default login page as usual as when i use the normal A app directly , and when i go to pages that does not need to be authenticated to get to it , it is returned without my css/js styles

this is my A app controller ( it is returning view not json )

    package com.hariri_stocks.controllers;

    import java.util.ArrayList;
    import java.util.List;

    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.beans.factory.annotation.Value;
    import org.springframework.stereotype.Controller;
    import org.springframework.ui.Model;
    import org.springframework.web.bind.annotation.GetMapping;
    import org.springframework.web.bind.annotation.PostMapping;
    import org.springframework.web.bind.annotation.RequestParam;
    import org.springframework.web.bind.annotation.ResponseBody;
    import org.springframework.web.bind.annotation.RestController;

    import com.hariri_stocks.models.Estates;
    import com.hariri_stocks.models.SoldEstates;
    import com.hariri_stocks.models.Users;
    import com.hariri_stocks.services.estatesService;

    @Controller
    public class LoginController {

        @Autowired
        estatesService ES;
        
        
        @GetMapping(value = "/")
        public String login() {
            return "/signIn-up.html";
        }
        
        @GetMapping(value = "/dashboard")
        public String dashboard(Model model ,@RequestParam(required = false) String add_result
                                                    ,@RequestParam(required = false) String alert_err) {
            List<Estates> estates = ES.findAll();
            model.addAttribute("estates",estates);

        return "/dashboard";
        }
        
        @GetMapping(value = "/dashboard/unSold")
        public String unselled_stocks(Model model) {
            List<Estates> estates = ES.findUnsold();

            if(estates.size() > 0) 
            model.addAttribute("estates",estates);
            
            else
            model.addAttribute("error","there is no sold estates yet !!");
            return "/dashboard";
        }
        
        @Value(value = "${server.port}")
        String port_num;
        
        @GetMapping("/port")
        public String hello() {
            return port_num;
        }
        
    }

and this is my loadbalancer controller iam using @restcontroller

    package com.hariri_loadbalancer;

    import reactor.core.publisher.Mono;

    import org.springframework.boot.SpringApplication;
    import org.springframework.boot.autoconfigure.SpringBootApplication;
    import org.springframework.cloud.client.loadbalancer.reactive.ReactorLoadBalancerExchangeFilterFunction;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RestController;
    import org.springframework.web.reactive.function.client.WebClient;

    @SpringBootApplication
    @RestController
    public class UserApplication {

      private final WebClient.Builder loadBalancedWebClientBuilder;
      private final ReactorLoadBalancerExchangeFilterFunction lbFunction;

      public UserApplication(WebClient.Builder webClientBuilder,
          ReactorLoadBalancerExchangeFilterFunction lbFunction) {
        this.loadBalancedWebClientBuilder = webClientBuilder;
        this.lbFunction = lbFunction;
      }

      public static void main(String[] args) {
        SpringApplication.run(UserApplication.class, args);
      }

      @RequestMapping("/port")
      public Mono<String> showMePort() {
        return loadBalancedWebClientBuilder.build().get().uri("http://hariri/port")
            .retrieve().bodyToMono(String.class);
      }
      @RequestMapping("/")
      public Mono<String> showMainPage() {
        return loadBalancedWebClientBuilder.build().get().uri("http://hariri/")
            .retrieve().bodyToMono(String.class);
      }
    }

So what should I do? I feel that what I am doing is stupid, should I move all my Thymleaf pages to the loadbalancer maybe , so that the a app return what it want to return with @restController then the loadbalancer use @controller to get to the styling front pages or there is a way , and for the security , should i implement the spring security with the loadbalancer instead of the A,B apps ......................... 8080 is loadBalancer port 9091 is A app port so it seams that when A is returning the html page , the html is searching for the css at the loadbalancer machin at 8080 , while they are existing at A app on 9091

Answer 1

bodyToMono decodes the body but you are not handling headers. On spring security there is very likely a redirection to the login page ... so it wont work if you only attend to the body. This might be also affecting styles somehow.

Check something like this: How to extract response header & status code from Spring 5 WebClient ClientResponse