I need an advice on securing interaction between an application App and a microservice RecordApp.
App is the main application, where all users are registered and do some activity. RecordApp is a utility application where App users can store records that publicly visible in the App (like sub-twitter). RecordApp knows nothing about users, but each record ("tweet") needs to have an author. I need to provide ability to use the RecordApp from the frontend and don't use the App like a proxy. I have some options to do this:
The first is: User passes authentication on the App server and receives JWT token (that was signed using App public key) that tells that the user has name "User1" and can create public records. Then user sends this to RecordApp, it validates it (using RecordApp secret key) and sees that this user can create a record and then creates it. But if some hacker steals the User cookie, then the hacker can post malicious records by the name of "User1". I could solve this by setting httpOnly flag for the cookie, but App and RecordApp have different domains, so that wouldn't work.
What do I do to secure such microservice?
The second option is as user passes authentication on the App server, send to the user a public_key that will be used to sign jwt with the record contents. If the hacker will be able to steal it from the-middle, then they just can post this message unchanged. But what do I do to protect the public key then?
Thanks in advance!