Assuming any user with a JWT has access to all microservices can't you just validate a JWT within the API Gateway and be done. Then passing the request to the microservices without any further auth.
No really. Actually, the privilege authorization happens after the process of authentication. We can encode the access limitation specific logic in this phase, and these two processes mentioned above can be done at the API gateway layer.
In addition, the privileges required for a specific action or resource can be synchronized to the API Gateway, we can easily compare the privileges decrypted from the JWT with that from other micro services to implement our own access control logic.
This was really informative. Thank you.
Great. Answering many questions
Gold content!!!
Great Vedio
Great video! thanks
informative video, thanks for sharing!!
Thank you!
"we trust each other" in "zero trust" arch is kind of funny
Assuming any user with a JWT has access to all microservices can't you just validate a JWT within the API Gateway and be done. Then passing the request to the microservices without any further auth.
No really. Actually, the privilege authorization happens after the process of authentication. We can encode the access limitation specific logic in this phase, and these two processes mentioned above can be done at the API gateway layer.
In addition, the privileges required for a specific action or resource can be synchronized to the API Gateway, we can easily compare the privileges decrypted from the JWT with that from other micro services to implement our own access control logic.