I hope this post fits in this community :)

I'm trying to wrap my head around how authentication works with micro services.

Say we have a system, with a frontend, that communicates with an API gateway, which in turn communicates with all the micro services.

As I understand it, we authenticate the client in the API gateway, and if we trust the client, the request are forwarded to the micro services.

However, what is stopping a malicious actor from bypassing the API gateway and communicating directly to the micro services ?

Do we solve this problem using a firewall, so only trusted traffic reaches the micro services ?

Or do we still have API keys between the API gateway and the micro services ?

Or is there a third way ? :)

All the articles I've read seem to assume, that we can trust all traffic entering the micro services

Currently, it is possible to follow both Lemmy users and communities from Mastodon.

When you follow a user, all their posts and comments show up as posts on Mastodon.

When you follow a community. The community boosts all posts and comments made in the community.

I think it would work better, if for users, only posts showed up as posts and comments showed up as replies (meaning unlisted).

For communities, I think it would be better if only posts were boosted and not all the comments.

It is possible to find the comments by clicking on the post on Mastodon, so the comments would still be visible.

As it is now, following something from Lemmy from Mastodon is a noisy experience. I think it would be a lot better if only posts were boosted and shown as posts :)

I hope this is the right community to share this. If not, where can I share this ?

Have a nice day :)