#How to secure microservices archerecture.??

1 messages · Page 1 of 1 (latest)

edgy mason
#

Like i wanna know what is the way to secure microservices architecture like the in 2 possible situations.

  1. when there is a user to microservice communication

  2. when there is a service - service communication

jade hollowBOT
#

<@&1004656351647117403> please have a look, thanks.

edgy mason
#

Addition :- after some research I came to know about TLS and mTLS Integration between service to service communication

#

Or a JWT but I have no idea how to integrate it(MTLS OR TLS)

crystal crown
#

"secure" is too broad, could you narrow or further clarify the question?

#

Adding TLS is straight forward, you first need to grab a SSL certificate. You can get one for free from AWS or https://letsencrypt.org/

Let's Encrypt

Let's Encrypt is a free, automated, and open certificate authority brought to you by the nonprofit Internet Security Research Group (ISRG). Read all about our nonprofit work this year in our 2023 Annual Report.

#

Then whatever library you're using will have the tools already available to use it

edgy mason
#

Of a user

#

Who tries to access resources

crystal crown
#

JWT is all about authentication and authorization

#

essentially, a JWT might contain something like the userId and "scope" i.e. the permissions they have

# 
{
 "userId": "1234-5678-9",
 "scopes": ["user.read", "user.write"]
}```
#

and any other permissions

#

it's then "signed" using a secret key that you own

edgy mason
#

Hm so how can I pass it from ApiGateway to other service?? The requested one bu user

crystal crown
#

via the Authentication header

edgy mason
#

Also I wana know What is Keyclock can it help me in this case.??

edgy mason
crystal crown
#

so when you make a POST/GET/etc request, you can set a header "Authorization: <token>" and then validate it on the microservice

edgy mason
#

Or using a filter .??

crystal crown
#

well I'm assuming when the user presses a button on your app, you send a HTTP request to the backend?

edgy mason
crystal crown
edgy mason
crystal crown
#

generally, if you don't understand the product from reading the official sources, you're going to struggle regardless and it might not be a good option

#

because if you don't understand their docs, if you get problems, you won't be able to easily fix it

edgy mason
#

Got it

edgy mason