REST and service to service authentication

user_1248254 0
Viewed 1047

I am working on microservice application and now thinking how to handle security in service to service call.

For simplicity, imagine I have only two services:

  1. Api gateway (exposed to the internet)
  2. Service A (in DMZ, reachable only via API gtw)

Service A has a POST endpoint, let's say POST /customers to create a customer.

I also have POST endpoint on Api Gateway POST /gtw/customers. This works in a way that it does some validation (call some other service) and if everything is ok, then it delegates the request to Service A.

What I want to achieve is that endpoint in service A can be called only by API gateway (so the validation is applied). I am considering two approaches:

  1. Secure the endpoint in Service A by JWT token and API gateway will generate the token and then it can call the endpoint in Service A
  2. Leave it as it is because service A is running in DMZ, so it cannot be called directly (so basically it is secured on "infrastructure" level).

Is it good approach at all to handle service to service authentication by JWT tokens?

microservices jwt rest security
2 Answers

Let's discuss both

Secure the endpoint in Service A by JWT token and API gateway will generate the token and then it can call the endpoint in Service A

Sometime Authentication is not the only thing. Authorization also has a great part to play. If your service has functionality based on roles then this approach is must. Your gateway will authenticate the token and will pass you the same token. JWT will contain the claims which may include roles as well. So you must re-validate and extract the claims before you full fill the request based on role. Even in inter-service communication the services should be passing the JWT token along with request and your service should validate it. I always prefer this approach since JWT can always be validated locally and you can avoid Http round trip , so it doesn't slow down the flow.

Leave it as it is because service A is running in DMZ, so it cannot be called directly (so basically it is secured on "infrastructure" level

This approach is for simple Http calls but is only valid if you have backend services running in private subnet or DMZ. You should only use this approach for simple services and should never be used for services that hold sensitive data.

user_10419530

As per my knowledge I would suggest you to use OAuth in order to secure service to service authentication. For your specific case , you can use Client credentials grant type. It is fairly easy to implement as well. Using JWT is one of the ways to do it, but for your case I feel OAuth 2.0 with Client Credentials grant access would be a perfect match.

user_115229140
Related