We have a Java Zuul gateway microservice that runs infront of all of our services. This gateway provides security check for all inbound traffic.
We also have an IAM service that provides login/logout/create user functionalities that sits behind the gateway. These endpoints would take in passwords.
We want to make sure that clear text passwords travel in as small sections of our systems as possible. We can have the gateway hashing the password in a zuul filter and then pass the requests on to IAM. But if someone bypasses the gateway somehow, they can potentially reach the endpoint with a stolen hash and use it to gain access, like a "Pass The Hash" kind of attack. So we would want to rehash the hash that was generated by the gateway and then store the value in database.
The question is, is there any potential problem with double hashing between microservices? To name a specific implementation, let's say BCrypt, would this work?