I'm not quite sure if this question is allowed here or maybe it's too broad (if not I apologize).
Let's say I have 2 spring-boot applications (.war files). One holds REST endpoints, the other static JS files (SPA application).
Both should be using spring-security, and using same data base to query users, same redis to cache sessions (spring-session).
How would I go about this? I saw something like that in spring examples using spring-cloud zuul, though it's not quite what I was hoping.
How should I protect multiple spring-boot appliactions deployed in same tomcat using spring-security? To make 1 spring-boot application responsible for authorization and authentication, should I resort to tokens and sending them with each rest request?
Any ideas and suggestions?