Working with API Gateway

<dependency>
  <groupId>org.springframework.cloud</groupId>
  <artifactId>spring-cloud-starter-gateway</artifactId>
</dependency>

spring:
  cloud:
    gateway:
      routes:
        - id: orders-route
          uri: lb://orders
          predicates:
            - Path=/api/orders/**
          filters:
            - StripPrefix=1
        - id: users-route
          uri: http://user-svc:8080
          predicates:
            - Path=/api/users/**

@Bean
RouteLocator routes(RouteLocatorBuilder b) {
  return b.routes()
    .route("orders", r -> r.path("/api/orders/**")
       .filters(f -> f.stripPrefix(1).addRequestHeader("X-Source", "gateway"))
       .uri("lb://orders"))
    .build();
}

@Component
public class CorrelationIdFilter implements GlobalFilter, Ordered {
  @Override public Mono<Void> filter(ServerWebExchange exch, GatewayFilterChain chain) {
    String id = Optional.ofNullable(exch.getRequest().getHeaders().getFirst("X-Correlation-Id"))
                        .orElse(UUID.randomUUID().toString());
    ServerHttpRequest mutated = exch.getRequest().mutate().header("X-Correlation-Id", id).build();
    return chain.filter(exch.mutate().request(mutated).build());
  }
  @Override public int getOrder() { return -1; }
}

spring:
  cloud:
    gateway:
      routes:
        - id: orders
          uri: lb://orders
          predicates: [ Path=/api/orders/** ]
          filters:
            - name: RequestRateLimiter
              args:
                redis-rate-limiter.replenishRate: 100
                redis-rate-limiter.burstCapacity: 200
                key-resolver: "#{@principalKeyResolver}"

@Bean
KeyResolver principalKeyResolver() {
  return ex -> ex.getPrincipal().map(Principal::getName).defaultIfEmpty("anonymous");
}

spring:
  cloud:
    gateway:
      globalcors:
        cors-configurations:
          '[/**]':
            allowed-origins: "https://app.example.com"
            allowed-methods: "*"
            allowed-headers: "*"
            allow-credentials: true
            max-age: 3600

@Bean
SecurityWebFilterChain security(ServerHttpSecurity http) {
  return http
    .authorizeExchange(a -> a
      .pathMatchers("/actuator/health", "/api/public/**").permitAll()
      .anyExchange().authenticated())
    .oauth2ResourceServer(r -> r.jwt(Customizer.withDefaults()))
    .csrf(ServerHttpSecurity.CsrfSpec::disable)
    .build();
}

@SpringBootTest(webEnvironment = WebEnvironment.RANDOM_PORT)
class GatewayRouteTests {
  @Autowired WebTestClient client;
  @Test void routesOrders() {
    client.get().uri("/api/orders/1").exchange()
          .expectStatus().isOk()
          .expectHeader().exists("X-Correlation-Id");
  }
}

spring:
  cloud:
    gateway:
      discovery:
        locator:
          enabled: true              # auto-route /service-name/**
          lower-case-service-id: true