I'm looking into setting up authentication between two application services. Service A is going to call service B, and I want service B to only accept (http) calls from service A, nowhere else.
I know how JWT authentication works and could implement that. If I understand correctly (I think I do, but correct me if I'm wrong), it works like this:
- service A requests a JWT from service B (or an identity server, but let's assume point-to-point)
- service B responds with the JWT, signed with service B's secret
- service A makes the call to service B and includes the JWT
- service B inspects the JWT and can know if it was actually service A that made the call, without tampering with the JWT
But is the first call actually necessary? Couldn't I just do this:
- service A signs every request with service A's private key
- service B decrypts the request with service A's public key
- service B now knows if the request is really from service A
I will be working over https, and have no need for claims. All I need to know is if the request originated from service A. Because only service A is allowed to call service B, but when it does, it has access to all API endpoints (so no claims necessary).
It seems simpler to use asymmetric encryption instead of JWT, but I wonder if it's as secure, correct and standard to do so.