Securing our Microservices by Authentication and Authorization with JWT, Refresh Tokens and RBAC (2024)

FAQs

How to secure microservices with JWT? ›

For Authorization, the Microservice would need the JWT access token to be passed to it. It can then verify the JWT token & extract the user roles from the claims & accordingly allow/deny the request for the concerned endpoint.

To authenticate a user, a client application must send a JSON Web Token (JWT) in the authorization header of the HTTP request to your backend API. API Gateway validates the token on behalf of your API, so you don't have to add any code in your API to process the authentication.

One common approach to implement authentication in microservices is to use a centralized identity provider (IdP) that issues tokens to authenticated users or services. Tokens are typically JSON Web Tokens (JWTs), which are digitally signed and contain claims about the identity and attributes of the token holder.

The sequence of steps for implementing JWT refresh token in a Spring Boot application is as follows in below diagram: - When a client accesses protected resources, they must include a valid JWT in the HTTP Authorization Header. Upon user sign-in, a refreshToken will be issued.

JWT dedicated to a particular micro-service, or a set of micro-services. When service A need to call service B, first it calls the authz server to exchange its A-token for a B-token. B-token contains only claims that are of interest to service B.

To protect microservices, use a distributed system to prevent bottlenecks, including implementing rate limiting. Security and safe communication should be a priority for each small part, no matter the programming language. Having a detailed plan for securing these separate parts is crucial.

Choosing between JWT and server-side token authentication depends on your use case, security needs, and scalability requirements. JWT is suitable for stateless scenarios and APIs, while server-side tokens work best for session-based authentication in web applications.

JWT is a useful tool for protecting API endpoints. When using a JWT, the client first authenticates with the server. The server then responds with a JWT. The client then includes the JWT in subsequent requests to the server.

A user has to hit an endpoint ("/login") with username and password and generate a token and pass this as a RequestHeader to all end points in both the services. Say in microservice A, I have an endpoint ("test1/createSomething"). In B I have another have an endpoint ("test2/getSomething").

Token-Based Authentication:

When users authenticate through SSO, they receive a security token (such as an OAuth access token or OIDC ID token) from the IDP. This token can then be used to access protected resources in various microservices.

How do you authenticate between two microservices? ›

To perform authentication based on entity context, you must receive information about the end-user and propagate it to downstream microservices. A simple way to achieve this is to take an Access Token received at the edge and transfer it to individual microservices.

The API returns a short-lived token (JWT), which expires in 15 minutes, and in HTTP cookies, the refresh token expires in 7 days. JWT is currently used for accessing secure ways on API, whereas a refresh token generates another new JWT access token when it expires or even before.

When using the Org Authorization Server, the lifetime of the JSON Web Tokens (JWT) is hard-coded to the following values: ID Token: 60 minutes. Access Token: 60 minutes. Refresh Token: 90 days.

Upon successful login, the server creates a JWT containing user information and a signature to verify its authenticity. The server sends the JWT to the client. Then, each subsequent request from the client includes the JWT. The server validates the token's signature to ensure it hasn't been tampered with.

While session-based authentication may be well-suited for traditional web applications with stateful operations, JWT offers advantages in stateless architectures, microservices environments, and scenarios requiring cross-domain authentication.

The first and most basic way to ensure secure communication between microservices is to use HTTPS and TLS protocols. HTTPS is the secure version of HTTP, which encrypts the data between the client and the server using SSL or TLS certificates.