27
Authentication in microservices (feddit.dk)
submitted 9 months ago by to c/programming@programming.dev
11 comments fedilink hide all child comments
 

I hope this post fits in this community :)

I'm trying to wrap my head around how authentication works with micro services.

Say we have a system, with a frontend, that communicates with an API gateway, which in turn communicates with all the micro services.

As I understand it, we authenticate the client in the API gateway, and if we trust the client, the request are forwarded to the micro services.

However, what is stopping a malicious actor from bypassing the API gateway and communicating directly to the micro services ?

Do we solve this problem using a firewall, so only trusted traffic reaches the micro services ?

Or do we still have API keys between the API gateway and the micro services ?

Or is there a third way ? :)

All the articles I've read seem to assume, that we can trust all traffic entering the micro services

you are viewing a single comment's thread
view the rest of the comments
[–] 8 points 9 months ago (2 children)

I mean, both sound valid. I'd say the first option is likely the most common: some kinda firewall or private network that keeps your microservices isolated from the public internet. In a practical sense, odds are all of this stuff is physically co-located anyway, so it could even be that the networks are physically isolated as well.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] [S] 3 points 9 months ago (1 child)

    Thanks for the answer :)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 9 months ago

    The walled garden (micro services in an isolated network) is the first line of defense. In case a malicious actor finds a way into that network, the second line of defense would be to authenticate the service-service traffic, so the micro services reject direct requests from clients they aren't expecting.

  • permalink
  • fedilink
  • source
  • parent