I hope this post fits in this community :)
I’m trying to wrap my head around how authentication works with micro services.
Say we have a system, with a frontend, that communicates with an API gateway, which in turn communicates with all the micro services.
As I understand it, we authenticate the client in the API gateway, and if we trust the client, the request are forwarded to the micro services.
However, what is stopping a malicious actor from bypassing the API gateway and communicating directly to the micro services ?
Do we solve this problem using a firewall, so only trusted traffic reaches the micro services ?
Or do we still have API keys between the API gateway and the micro services ?
Or is there a third way ? :)
All the articles I’ve read seem to assume, that we can trust all traffic entering the micro services
This is obviously overkill for most infras, but in a previous position, because we had granular rights, we would forward JWT tokens from the API Gateway to the microservice (and from one microservice to another) so that every µService could validate the token and ask the Rights µService whether it had the required rights for the operation.