Information Security

Questions tagged [microservices]

Ask Question

The tag has no usage guidance.

11 questions
Newest
Active
Bountied
Unanswered
Filter by
Sorted by
Tagged with
2
votes
0answers
36 views

Assuming secure code practices are adhered to, is a thousand-tier/n-tier microservices application or a monolithic application more secure? [closed]

Assuming secure code practices are all adhered to for both applications, is a thousand-tier/n-tier microservices application or a monolithic application more secure? From a monitoring, visibility ...
1
vote
0answers
52 views

A single microservice (e.g., a spring boot jar) can be dependent on more than 100 libraries - how to ensure that none of these are compromised? [duplicate]

It took only one DLL, the SolarWinds.Orion.Core.BusinessLayer.dll, to bring so many companies to the knees. To be more precise, just a couple lines of code in the single DLL. In today's cloud-native ...
0
votes
0answers
32 views

client security separate from user context

Consider the following set up applications and services: apps: mycompany.com webapp apis: products api orders api mycompany.com's webapp uses OAuth2/openidconnect with an IdP (such as auth0) to ...
2
votes
1answer
149 views

Propagating user context between microservices secured with M2M JWT tokens

We have a current microservice architecture where we secure communication between microservices via Machine-To-Machine access tokens (these tokens are obtained using the Client Credentials grant flow)....
0
votes
1answer
54 views

In Microservice Architecture, how to secure inter service to service

In Microservice architecture, public clients & confidential clients are there as per API Gateway Pattern, Public clients connecting from Browser to backend reaches it via API Gateway API Gateway ...
0
votes
0answers
32 views

How to prevent horizontal escalation attacks when a centralized authorization service as gateway is used?

Say I have a gateway which provides authorization mechanisms by validating a JWT, behind an api-gateway there are different micro-services but only the gateway port is public. As a software designer ...
0
votes
0answers
48 views

JWT Propagation Across Services

I am looking into using OpenID Connect as a means of authentication across potentially multiple microservices. Consider the following chain of events: Client successfully obtains an access token, ...
1
vote
1answer
132 views

Disable SSL verification between isolated microservices

I have an internet isolated EC2 instance which is a Ruby client and it is connecting with multiple EC2 servers of mine in the same network having different sub-domain names. These EC2 servers are ...
1
vote
0answers
42 views

Generate new AccessToken each time user update his Information

im building a PWA app , where i implemented jwt token to auth users. i have 2 main architecture problems ,but let me introduce you what im building . i'm Building application that is all about dog ...
0
votes
1answer
236 views

Microservice security: How to perform authorization + services also need auth checks individually?

I have the following architecture for accessing a REST service that requires authentication: Oidc token flow managed at the client Access token verified at the server in the auth service (proxied ...
3
votes
1answer
125 views

Is it necessary to protect the Oauth2 return URL

I am thinking to implement a REST service that needs to call another REST service that is protected by OAuth2. My service is "always" called server to server by web applications. The user interacts ...