Suppose there is a e-commerce microservice architecture with the format:

microservice architecture

In summary, a client will contact the Auth Service / Identity Service to receive a token. It passes the token to the API gateway, which verifies the token, and forwards the request.

That being said, there are services that need to be accessed when a user is not logged in, such as viewing the products on the homepage. This means they wont have a token, and will get rejected by the API gateway.


Is there a way to design this where a user can access certain services without being logged in ?

Some ideas that came to mind were a guest token with limited roles, or splitting services into authorized and non authorized parts e.g. ProductInfoService, ProductCreateService, etc.

  • I'm not quite following the question here. Why not just designate the need for authentication (or even specific authorization where relevant) on an endpoint-by-endpoint basis? Based on the problem outlined here, that's exactly the situation you find yourself in. I'm not sure why you're then working either under the assumption or under a design where this is defined per service as a whole.
    – Flater
    Commented Oct 21, 2022 at 6:07
  • 1
    Is there a way to design this where a user can access certain services without being logged in ? Don't make them go through the auth service... In this case, the API Gateway. So yes, the problem I see (I guess) is your API Gateway doing something it's not supposed to do... Authorization.
    – Laiv
    Commented Oct 21, 2022 at 7:04
  • @Flater I figured that if I have it on an endpoint by endpoint basis, it would result in a lot of duplicate code. Thanks for the feedback Commented Oct 21, 2022 at 15:09
  • @Laiv I suppose it shouldn't be authorizing. Good point Commented Oct 21, 2022 at 15:11
  • I disagree with previous comments. Authorization is a cross-cutting concern in an application and therefore should not be handled by each service separately but by the API gateway. Having said this, I see no reason not to go with any of your described solutions. Commented Oct 22, 2022 at 21:43


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.