We have a microservices architecture. One of the components is an Authentication & Authorization Service, which implements OAuth2 standard using encrypted JWTs. On each authentication of a user to any component, the component sends a REST to the service to get an access token. On each REST interaction of a user to any component, the component sends a REST with the user's access token to the service to authorize their right to do the interaction. I have two concerns:
- Components talk over SSL. OAuth2 requires JWTs to be encrypted, so we blindly follow that and encrypt them. So, encrypted token travels inside the SSL which doesn't make sense to me, but we have a requirement to follow the OAuth2. I feel like OAuth2 means that the JWTs must be encrypted in general, not independently of whether we use encrypted protocol or not (but I am not sure about that).
- We always ask a remote service for the rights verification, but I feel like a component could just use a public key to verify the JWT's signature and simply read the payload to find the demanded
ROLEentry in there without involving the network.