0

Context

Suppose there is a e-commerce microservice architecture with the format:

microservice architecture

In summary, a client will contact the Auth Service / Identity Service to receive a token. It passes the token to the API gateway, which verifies the token, and forwards the request.

That being said, there are services that need to be accessed when a user is not logged in, such as viewing the products on the homepage. This means they wont have a token, and will get rejected by the API gateway.

Question

Is there a way to design this where a user can access certain services without being logged in ?

Some ideas that came to mind were a guest token with limited roles, or splitting services into authorized and non authorized parts e.g. ProductInfoService, ProductCreateService, etc.

Improve this question
6
  • I'm not quite following the question here. Why not just designate the need for authentication (or even specific authorization where relevant) on an endpoint-by-endpoint basis? Based on the problem outlined here, that's exactly the situation you find yourself in. I'm not sure why you're then working either under the assumption or under a design where this is defined per service as a whole.
    – Flater
    Oct 21, 2022 at 6:07
  • 1
    Is there a way to design this where a user can access certain services without being logged in ? Don't make them go through the auth service... In this case, the API Gateway. So yes, the problem I see (I guess) is your API Gateway doing something it's not supposed to do... Authorization.
    – Laiv
    Oct 21, 2022 at 7:04
  • @Flater I figured that if I have it on an endpoint by endpoint basis, it would result in a lot of duplicate code. Thanks for the feedback
    – Gianluca Fuoco
    Oct 21, 2022 at 15:09
  • @Laiv I suppose it shouldn't be authorizing. Good point
    – Gianluca Fuoco
    Oct 21, 2022 at 15:11
  • I disagree with previous comments. Authorization is a cross-cutting concern in an application and therefore should not be handled by each service separately but by the API gateway. Having said this, I see no reason not to go with any of your described solutions.
    – Sebastian Sotto M.
    Oct 22, 2022 at 21:43

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.