Contents
How do you maintain a session between two microservices?
A different approach to authentication and session management is needed to ensure a scalable architecture.
- Authenticating Microservices Requests.
- Distributed Session Management in Microservices.
- Session Tokens with an API Gateway.
- OAuth and Authenticating with Third-Party Applications.
How JWT works in microservices?
Each microservice will validate JWT it receives and then for the downstream service calls, it can create a new JWT signed by itself and sends it along with the request. Also another approach is to use a nested JWT — so the new JWT will also carry the previous JWT.
How are tokens used in a microservices service?
Then, the STS uses information derived from the MFA to determine which token to provide the user at the start of the session. This token remains with the user throughout the session, still managed by the STS, and each service the user tries to access checks the token to allow or deny access.
Is it OK to pass on OAuth access token between services?
If each microservice is verifying the token then we can pass the same token. But the problem is – in between same token can be expired. If we use client_credentials grant then there we are having two issues: one is, we need to send the username/id in next microservice.
What do you need to know about microservices authentication?
This microservice authentication approach will also require a security token service (STS). Figure 1. Microservices token-based authentication arose from the trend away from SOA to distributed architectures. The concept of the STS stems from service-oriented architecture, when WS-Trust became a standardized security protocol for token management.
What are best practices for communication between microservices?
The plan is for a microservices architecture using the Spring Cloud framework and Spring Cloud OAuth for security. My question is really on best practices for communication between microservices: Should I have each service register for their own token, or should they just pass the user’s token around?