Timeline for What is the most common stateless way for authentication in microservices?
Current License: CC BY-SA 4.0
12 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 27, 2020 at 16:31 | comment | added | JimmyJames | Also, you might want to read this article referenced in the comments of that answer: sjoerdlangkemper.nl/2016/09/28/attacking-jwt-authentication | |
| Oct 27, 2020 at 16:30 | history | edited | JimmyJames | CC BY-SA 4.0 |
note added.
|
| Oct 27, 2020 at 16:28 | comment | added | JimmyJames | That's not my area of expertise but I think in general, having a third party identity broker is the way things are going. Usernames and passwords are going the way of the dodo because they are fundamentally broken. Here's an article for more: linkedin.com/pulse/… | |
| Oct 27, 2020 at 16:21 | comment | added | Muizz Mahdy | I see, so client authentication is optimal for server-to-server interactions, and not user-to-server. Sorry for the confusion again. | |
| Oct 27, 2020 at 16:20 | comment | added | Muizz Mahdy | Sorry for the confusion, end users will use a javascript single page app from the browser, and authenticate by entering their username and password, just as most web apps do. My issue is that I am not sure whether I should use OAuth2 (or OIDC) or the usual authentication from a gateway service (which handles the generation and verification of JWTs). | |
| Oct 27, 2020 at 16:14 | comment | added | JimmyJames | Also, I don't think you understand the linked answer. JWTs can be intercepted and used in replay attacks. The fact that they expire is a requirement because of that. PKI schemes are not subject to this. The private key must be leaked. While that's possible, if you store the key properly, the client machine would have to be compromised and it's game over anyway, if we are talking about server-to-server interactions. There's also nothing stopping you from expiring your certs daily, hourly, whatever you think is right. | |
| Oct 27, 2020 at 16:08 | comment | added | JimmyJames | Your question says "The API is only going to be accessed by a single client (web app)" and you mention server-to-server authentication. What is your use case exactly? | |
| Oct 27, 2020 at 15:53 | comment | added | Muizz Mahdy | This question's most liked answer explains why JWTs are recommended when compared to client certificate security.stackexchange.com/questions/128185/… | |
| Oct 27, 2020 at 15:50 | comment | added | Muizz Mahdy | I may have not understood client certificate authentication properly, but isn't it based on certificates exchange instead of username & password validation? Wouldn't It require every application user (the actual end user) to own a local certificate that would be sent in every request? | |
| Oct 27, 2020 at 15:03 | comment | added | JimmyJames | I don't see how going out to a third server to get a key is going to be more efficient than using a local certificate. As far as stateless goes, it's part of the TLS connection. It's part of the handshake. Can you explain a little more what you think would be the problem? | |
| Oct 27, 2020 at 12:29 | comment | added | Muizz Mahdy | Makes sense, however is client certificate authentication stateless? Isn't the use of web tokens when it comes to stateless authentication more efficient? | |
| Oct 26, 2020 at 20:14 | history | answered | JimmyJames | CC BY-SA 4.0 |