I am rearchitecturing and rewriting my monolithic BaaS solution into microservices regarding to scalability and single responsibility rules. Due to the internal dependencies, services are placed on different logical tiers. See figure below;
Instead of directly accessing to database or key-value storage, each service in
Tier 2 must use
Data Storage Service. Target of the internal service calls are located via Configuration Service hosted independently from API Gateway. API Gateway is deployed and configured per product. Product has an apikey and apisecret.
- End users can login to the hosted product. (http*://host/authentication/login)
Business Serviceserves a custom logic: MyClass.MyOperation() (http*://host/business/myclass/myoperation)
- End users of
Business Servicemust be authenticated via
Authentication Serviceto use the business logic (token based authentication)
On monolithic architecture, I was able to intercept dispathced business invocations via configured interceptors inside current executing http task. Therefore I was able to receive AuthenticationToken from business service request and decide whether the end user has authenticated via authentication service by directly querying the key-value storage.
Following the micoservice architecture, before executing business logic
Business Service should make a request with transferring all original request headers to the
Authentication Service, awaits its response, then parse the authentication result, and executes desired business logic then pipes to the response task. Single responsibility, fair enough.
- Considering each
Tier 2services can be distributed anywhere inside the network, what options do I have in order to safely distinguish the internal and external requests between gateway and microservices?
- Would this approach could be used to prevent internal service loop?