Authentication and Authorization for microservices architecture

Question

I have implemented microservices architecture in Spring Boot. All services are accessible from the front-end. There are 2 types of API in few Microservices -

Public - (Directly Accessible from the front-end)
Internal - (for inter-service communication)

I have implemented JWT based authentication. But I want to know how to implement auth for internal APIs? In internal API we will not get the JWT token. Auth is needed because someone can mock a private API. For Authentication, we are using an auth service. All other services call the Auth service before every API call to authenticate the request.

tom redfern · Accepted Answer · 2020-09-16 17:52:38Z

1

Auth is needed because someone can mock a private API

While this may be true, an attacker would need to be inside your network already.

However, assuming you still need secure intra-service communication, you could look at service discovery to mediate this communication. Service registry platforms such as Eureka or Consul, will allow you to set up service discovery.

Eureka is commonly used in sprint boot applications, and is fairly lightweight, but weighted toward AWS hosting.

In addition to other benefits, such as configuration management, failure detection, and load balancing, these platforms will also enable you to secure your intra-service communication.

edited Sep 16, 2020 at 17:52

answered Sep 16, 2020 at 14:57

tom redfern

32k15 gold badges97 silver badges138 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Authentication and Authorization for microservices architecture

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related