Worker Job Trigger Authentication
Describes how the platform secures worker job trigger endpoints using an authentication interceptor for all POST requests to /worker/v1/run-* paths.
Overview
The WorkerJobTriggerWebConfig component is a configuration class that integrates an authentication interceptor into the worker service's web API layer. Its sole purpose is to secure the API endpoints that trigger asynchronous worker jobs.
This component solves the problem of protecting sensitive job execution endpoints by ensuring that only authenticated requests can initiate them. It works by registering the WorkerJobTriggerAuth interceptor, which is applied to all incoming POST requests sent to paths matching the pattern /worker/v1/run-*.
How it works
The platform uses the Spring Framework's WebMvcConfigurer interface to apply cross-cutting security logic. The WorkerJobTriggerWebConfig class implements this interface to register a custom interceptor.
When the worker service starts, the Spring container invokes the addInterceptors method on this configuration class. This method adds the WorkerJobTriggerAuth interceptor to the application's interceptor registry and configures it to apply only to request paths that match the WorkerJobTriggerAuth.PATH_PATTERN constant.
As a result, any inbound HTTP POST request to an endpoint like /worker/v1/run-some-job is first routed to the WorkerJobTriggerAuth interceptor. This interceptor performs authentication checks. If authentication succeeds, the request is forwarded to the controller that handles the job trigger. If it fails, the interceptor halts further processing and rejects the request. The specific authentication logic is contained within the WorkerJobTriggerAuth component itself.
The following diagram illustrates the request flow:
sequenceDiagram
participant C as API Consumer
participant W as Worker Service
participant I as WorkerJobTriggerAuth Interceptor
participant H as Job Trigger Handler
C->>+W: POST /worker/v1/run-my-job
W->>+I: Pre-handle Request
Note over I: Performs authentication
I-->>-W: Authentication successful
W->>+H: Execute job trigger
H-->>-W: Job started
W-->>-C: 200 OK (or similar)Protected Endpoints
This configuration does not define new API endpoints but applies a security interceptor to an existing group of endpoints based on a path pattern.
| Method | Path Pattern | Description |
|---|---|---|
POST | /worker/v1/run-* | All POST requests to paths under /worker/v1/ that begin with run- are protected. These endpoints are used to trigger worker jobs. Authentication is handled by the WorkerJobTriggerAuth interceptor. |
NOTE
The * in the path pattern is a wildcard. Any path starting with /worker/v1/run- will be matched, such as /worker/v1/run-data-sync or /worker/v1/run-report-generation.
Configuration
The WorkerJobTriggerWebConfig component is an internal part of the worker service and is not configured directly by API publishers or consumers. It contains no user-configurable properties, flags, or environment variables. Its behavior is determined by its programmatic registration of the WorkerJobTriggerAuth interceptor.
See Also
WorkerJobTriggerAuth: The component responsible for implementing the authentication logic for worker job triggers. This interceptor is registered byWorkerJobTriggerWebConfig.