-1

I have a web service. When a user makes a request, traefik first redirects it to my users micro service, to pass through an authentication function.

The token (or username+password, on first request) is checked against my users database. If found, the authentication sets the context and passes on the request. If not found, it rejects it with code 401 unauthorized.

But the problem is when the user sends a signup request. Since he's signing up, he's not in the database yet. And so the authentication rejects and the request fail.

So far, the only solution I came up with was, if the user isn't found in the database, the authentication function directly calls the add new user function. But the problem is that this doesn't seem right, adding users seems outside of what an authentication function should do. Furthermore, the allowed request would then have to do nothing since the user was already created by the authentication!

This is a super common situation so I was wondering if anyone who has written such a workflow can tell me how this situation is "normally" dealt with. I don't want to reinvent the wheel!

7
  • Why is your sign up work flow authenticated at all? The use case should allow for anonymous traffic. Or are you specifically asking about the micro service responsible for adding a new user? Jun 1, 2023 at 2:15
  • @GregBurghardt All requests are redirected by traefik to the auth function. I could add a header to flag a request as "do not authenticate", but isnt that a huge security flaw? Anything with that header would just ignore authentication. If thats what you suggest by "anonymous traffic"
    – Juan Perez
    Jun 1, 2023 at 2:38
  • I think we need more information about who talks to who. Are you using JWT tokens? Jun 1, 2023 at 2:57
  • Are you conflating user management and auth in a single service? If yes, that's the root of the issue. Your architecture is not flexible enough to articulate the "security dance" from one service to another.
    – Laiv
    Jun 1, 2023 at 10:25
  • @Laiv Yes, my users microservice handles both the users database CRUDs as well as the authentication function. But I don't undersand why separating them would help..
    – Juan Perez
    Jun 1, 2023 at 12:40

1 Answer 1

5

Every web application has at least a few routes/endpoints that are accessible anonymously. If it isn't a sign-up page, it would be a home page telling prospective users what your application does and why they should sign up.

As publicly accessible pages are so common, there must also be a way to configure traefik to forward requests to the /signup endpoint directly to the Users service without going through the Auth service.

1
  • Traefik allows me to apply the auth redirect to the subdomains I choose. I could create a subdomain exclusively for signup (and other anonymous requests) and not apply auth there, I suppose
    – Juan Perez
    Jun 1, 2023 at 12:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.