Security

Question 1

Security patterns

Answer 1

Access Token

Question 2

Access token: context

Answer 2

You have applied the Microservice architecture and API Gateway patterns. The application consists of numerous services. The API gateway is the single entry point for client requests. It authenticates requests, and forwards them to other services, which might in turn invoke other services.

Question 3

Access token: problem

Answer 3

How to communicate the identity of the requestor to the services that handle the request?

Question 4

Access token: forces

Answer 4

Services often need to verify that a user is authorized to perform an operation

Question 5

Access token: solution

Answer 5

The API Gateway authenticates the request and passes an access token (e.g. JSON Web Token) that securely identifies the requestor in each request to the services. A service can include the access token in requests it makes to other services.

Question 6

Access token: example

Answer 6

See JSON Web Token for usage examples and supporting libraries.

Question 7

Access token: result

Answer 7

• The identity of the requestor is securely passed around the system
• Services can verify that the requestor is authorized to perform an operation

Question 8

Access token: related

Answer 8

The API Gateway uses this pattern.