2

We have a Java Zuul gateway microservice that runs infront of all of our services. This gateway provides security check for all inbound traffic.

We also have an IAM service that provides login/logout/create user functionalities that sits behind the gateway. These endpoints would take in passwords.

We want to make sure that clear text passwords travel in as small sections of our systems as possible. We can have the gateway hashing the password in a zuul filter and then pass the requests on to IAM. But if someone bypasses the gateway somehow, they can potentially reach the endpoint with a stolen hash and use it to gain access, like a "Pass The Hash" kind of attack. So we would want to rehash the hash that was generated by the gateway and then store the value in database.

The question is, is there any potential problem with double hashing between microservices? To name a specific implementation, let's say BCrypt, would this work?

  • Do your Zuul and IAM services live within the same datacenter? – user52472 Jun 13 '17 at 16:18
  • 1
    Would passing a JWT token with a short expiration into Zuul help? Only the server that issues the JWT should know the password. – rjdkolb Jun 13 '17 at 16:55
  • @rjdkolb That wouldn't prevent the attack vector described in the post. The attack described avoids the Zuul server all together. – user52472 Jun 13 '17 at 17:02
  • @user52472 We have them deployed to AWS, but they live in different AWS instances. – Yijiang Zhou Jun 13 '17 at 17:05
1

I do not see a problem with double hashing per se, but there are some trade offs to doing it this way. First and foremost, if an attacker is able to steal a hashed password as described, there is nothing preventing them from cracking that hash, and just using the password like a regular user. Secondly, if you need another service to access the IAM service, you would have to perform the same two-step hashing. Your solution becomes much less flexible at that point.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.