I have a dummy application that serves tickets separated in two apps and a database.
One app is the backend app, it knows only JSON and serves a port in a specific container locally. It handles everything persistent including users. It uses bearer token as authentication.
The other app is the web app which serves templated html. It serves the login page and is completely stateless.
My current approach is to serve, on successful login, the authentication bearer token in the client cookies. This is problematic because for security reasons this cookie is secure / HTTPOnly and I can't access it through the client's javascript to forge a backend request. So in order to call my backend I have to proxy through my stateless server who will translate the cookie auth into a bearer token for my backend.
This is causing duplication of the api, and my front web server is reduced to transparent cookie-to-bearer.
Is there any way to handle the auth flow in a microservice(s) architecture that allows js authed request and doesn't involve duplicating the api in the front web server ?
