I'm not sure the title is correct, so please advise if you think of a better title.
The scenario is:
- We have an API gateway that exposes REST API to our clients (web and mobile apps).
- We have a "sessions" microservice that keeps track of the logged in users. When a user logs in, a new session is stored in this microservice, and for each request that requires authentication, the API GW first communicates with this microservice to validate the session token and get session related information (user id, permissions list etc.)
- The API GW after validating the session performs some calls to other microservices that are required to fulfill the request, but some of them needs the logged in user ID.
A simple example is a blogs website, where the logged in user wants to add a post to his blog.
- Performs a POST to /posts with his new blog post and the session token (unique session ID)
- The request reaches the API GW.
- The API GW checks the session token against the sessions microservice that validates the token and returns the session data (user id, permissions)
- The API GW now need to send a request to the posts microservice to add the post to the user.
The question is about the 4th step - what would be considered a better practice:
Sending the user ID as part of the post object, meaning, the post service does not handle any authentication / autharization, it simply stores the object after basic validation of the object.
Using some sort of JWT that contains the sessions information and pass it with the blog post to the posts service, that must then validate the JWT and use the user ID from the JWT when storing the post data that was passed without any user ID in it?