I’m currently in need of some clarification for an authentication/overall strategy. First I will describe the use case and then the questions that arise for me.

Use Case

I want to have a single docker container consisting of an API and a database for each group of users. So for the sake of this example let’s say we have three docker containers A, B and C and three users for every container (A1, A2, A3, B1, B2, ...). Each of these users should only have access to their corresponding API. So e.g. user B1 can only read/write with API B.

The APIs should be consumed with multiple SPA FrontEnd Apps. To not have to log in on each app I want to implement a SSO flow with a single authentication Server. My thought was to let the user log in with the authentication server that responds with a jwt token (access and refresh) with the unique username in the payload. So on every request to an API Gateway that routes the user to the correct API (e.g. A1 -> A), the user sends the access token. The API then makes a request to the Authentication Server to verify the correctness of the jwt. If that‘s successful the API can log in the user with the specified username (because it also has a database entry of this unique user) over a remote user backend for example. This way if the routing or anything would go wrong the access token would be verified by the Authentication Server but the user A could not be logged into API B because there‘s no user with that name in the database of API B. The remote user header could also not be tempered with because every malicious request that sets this header would be prefixed with HTTP_.


  1. Is this even a secure/feasible authentication/authorization flow?

  2. Is there any default strategy for a use case like this (oidc?)?

  3. How do I safely store access/refresh tokens? Refresh token in a httpOnly cookie and the Short lived Access Token in-Memory of the Browser with a WebWorker or with Private static fields?

  4. Any possible obvious attack vectors?

  • 1) Have you considered OpenID Connect? 2) You ask actually multiple questions. This is against the policy of this site. Split your post into separate posts, one question per post. – mentallurg May 15 at 20:53
  • @mentallurg Thanks for your feedback. Oh well, I should have asked more like: Is this a feasible/secure approach or should I use/is there a ‚system‘ that already supports all of that. My bad. So OpenID Connect supports this ‚out of the Box‘? – TM.96 May 15 at 20:59
  • 1) Questions like "Is it feasible?" are opinions based and will be closed on this site. 2) Read about OpenID Connect. There are a lot of articles about it. If you then have specific questions, feel free to ask. – mentallurg May 15 at 21:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.