I hope this post fits in this community :)
I’m trying to wrap my head around how authentication works with micro services.
Say we have a system, with a frontend, that communicates with an API gateway, which in turn communicates with all the micro services.
As I understand it, we authenticate the client in the API gateway, and if we trust the client, the request are forwarded to the micro services.
However, what is stopping a malicious actor from bypassing the API gateway and communicating directly to the micro services ?
Do we solve this problem using a firewall, so only trusted traffic reaches the micro services ?
Or do we still have API keys between the API gateway and the micro services ?
Or is there a third way ? :)
All the articles I’ve read seem to assume, that we can trust all traffic entering the micro services
When I’ve done this it’s generally done with JWTs where each micro service is configured with a trusted public key that is used to authenticate the JWT. The JWT can be sent to the client when they log in, and used to authenticate all API requests (forwarding the JWT as necessary for service-to-service requests). It’s also possible to have a gateway mint JWTs after using some other means to authenticate client requests.
Sometimes service-to-service requests don’t have a client request in context to pull a JWT from. In those cases you need another authentication mechanism, like a different signed token, or a shared secret.