README

Automatically forwards JWT tokens between Symfony microservices when using HttpClientInterface.

If a user is authenticated with a Bearer token, this bundle ensures that all internal HTTP calls between services automatically propagate the JWT.
You no longer need to manually pass Authorization headers.

Features

✅ Automatically captures JWT from incoming requests
✅ Automatically forwards JWT when using Symfony HttpClientInterface
✅ Transparent: your services remain unchanged
✅ Lightweight — no external dependencies
✅ Compatible with Symfony 5.4, 6.x, 7.x
✅ Easy to extend and configure

Installation

composer require sbh/jwt-forwarding-bundle

Bundle Configuration

1️⃣ Register services

services:
    Sbh\JwtForwardingBundle\Service\JwtStorage: ~

    Sbh\JwtForwardingBundle\EventListener\StoreJwtListener:
        tags:
            - { name: kernel.event_listener, event: kernel.request, priority: 100 }

    Sbh\JwtForwardingBundle\Http\JwtForwardingHttpClient:
        decorates: 'http_client'
        arguments:
            - '@Sbh\JwtForwardingBundle\Http\JwtForwardingHttpClient.inner'
            - '@Sbh\JwtForwardingBundle\Service\JwtStorage'

2️⃣ Usage in your services

use Symfony\Contracts\HttpClient\HttpClientInterface;

class MyService
{
    public function __construct(private HttpClientInterface $httpClient) {}

    public function callOtherService(): void
    {
        $response = $this->httpClient->request('GET', 'http://service-b.local/api/data');
        $data = $response->toArray();

        // $data contains the response from Service B, with JWT automatically forwarded
    }
}

→ You don't need to pass Authorization manually — the bundle handles it transparently.

How it works

• StoreJwtListener listens to kernel.request, captures the current JWT:

Authorization: Bearer xxxxx.yyyyy.zzzzz

• JwtStorage stores the token temporarily for the current request.

• JwtForwardingHttpClient decorates HttpClientInterface, and automatically injects the token in:

Authorization: Bearer xxxxx.yyyyy.zzzzz

→ All internal HTTP calls will receive the token automatically.

Typical use case

• Microservice architecture:

Client → API Gateway (Symfony) → Service A → Service B

The same JWT token is forwarded:

From Client → API Gateway → automatic (default Symfony behavior)

From API Gateway (or Service A) → Service B → this bundle forwards the token ✅

Requirements

• Symfony 5.4, 6.x, or 7.x

• PHP 8.1+

Testing

• Run unit tests:

vendor/bin/phpunit

• Example test available: tests/JwtStorageTest.php

Roadmap / Ideas

• Provide config to exclude forwarding on some domains

• Provide logging / tracing (Monolog)

• Provide options to handle token refresh

• Provide options for custom header names (ex: X-Auth-Token)

Credits

• Developed by Said Ben Hmed

License

• MIT License.