I'm trying to get into Microservices by creating a project, so far I've stumbled upon authentication mechanisms, in a monolithic architecture, the client (web app) would send a request with the user credentials to receive a JWT and send it in every upcoming request. However, when it comes to Microservices I found out that there were two different ways to achieve the same, stateless authentication mechanism, either by delegating the authentication and authorization responsibilities to the gateway service, or by using OAuth2 (or OpenID Connect??). Most online resources recommend OAuth2, however isn't it used for service-to-service authorization? Should I use the authorization code flow with password grant?

The API is only going to be accessed by a single client (web app), so no other service is going to ask the user for their data consent or something.

  • In a microservice environment, there are 2 authentications in play: 1. The authentication of the user accessing the system 2. The authentication of the microservices among themselves. Which of those two are you referring to in your question? – Bart van Ingen Schenau Oct 27 at 7:04
  • @BartvanIngenSchenau I'm trying to implement the authentication of the user, which is why I'm not sure if OAuth is optimal in this case. – Muizz Mahdy Oct 27 at 12:29

NOTE This answer is not relevant to the question due to confusion about the use case. I am leaving it for now in case it's helpful to anyone else.

I don't know if it's the most common but this is a perfect use case for using client-certificates. This is also referred to as mutual authentication (mTLS)

Part of what makes this appealing in this kind of situation is that you likely are already managing a certificate on the client (the web-server.) If you aren't then you should fix that first. The only difference between a server-certificate and a client-certificate is that the latter is signed to allow it to be used for client authentication. This means that one certificate can be used for both its server-authentication and its client-authentication. You just need it signed for both capabilities.

mTLS is built into the TLS standard and generally requires no additional libraries. If a request can't produce an acceptable cert, they are stopped before they get an opportunity to poke at any part of your web API. The biggest challenge tends to be figuring out how to make your host accept them and pass the identity details (e.g. subject) to the auth module of your framework. One fairly simple approach is to let a reverse-proxy do this and pass these details along on a header. Just make sure you clear anything that a client (attacker) might try to pass in on that header or headers.

| improve this answer | |
  • Makes sense, however is client certificate authentication stateless? Isn't the use of web tokens when it comes to stateless authentication more efficient? – Muizz Mahdy Oct 27 at 12:29
  • I don't see how going out to a third server to get a key is going to be more efficient than using a local certificate. As far as stateless goes, it's part of the TLS connection. It's part of the handshake. Can you explain a little more what you think would be the problem? – JimmyJames Oct 27 at 15:03
  • I may have not understood client certificate authentication properly, but isn't it based on certificates exchange instead of username & password validation? Wouldn't It require every application user (the actual end user) to own a local certificate that would be sent in every request? – Muizz Mahdy Oct 27 at 15:50
  • This question's most liked answer explains why JWTs are recommended when compared to client certificate security.stackexchange.com/questions/128185/… – Muizz Mahdy Oct 27 at 15:53
  • Your question says "The API is only going to be accessed by a single client (web app)" and you mention server-to-server authentication. What is your use case exactly? – JimmyJames Oct 27 at 16:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.