Questions tagged [microservices]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
35 views

Security Risks with Event Streaming

At a high level based on the technology of event store and streaming (i.e. Apache Kafka, Amazon Kinesis, etc.) to decouple systems and make them event driven systems. I was wondering what new ...
0 votes
0 answers
23 views

Using public OAuth tokens to authorize access to internal services

Here's the deal. This might probably be a known best practice, but I haven't been able to find anything on the matter. Suppose company X has a public facing web API server, and a public OAuth Identity ...
  • 23
1 vote
1 answer
97 views

Can the services inside the VPC be authentication less?

We have a micro-services architecture, where many microservers need to talk to each other for data. These services are inside a VPC. I need to understand if the HTTP APIs of these microservices need ...
2 votes
1 answer
118 views

Error code prefixes specific to specific micro services a vulnerability?

If your microservice architecture responds with error codes revealing which microservice had an error, doesn’t this reveal to the caller information on how your microservice architecture is designed? ...
  • 121
1 vote
1 answer
696 views

Setting httponly secure cookies in microservice architecture

I have read that storing the jwt token within the httponly secure cookie is the recommended way to prevent both csrf attacks and xss attacks. When a user goes to my website they may make an api call ...
  • 13
2 votes
2 answers
160 views

Access Control for REST APIs - OWASP recommendation

OWASP states: Non-public REST services must perform access control at each API endpoint. Web services in monolithic applications implement this by means of user authentication, authorisation logic ...
2 votes
0 answers
77 views

Assuming secure code practices are adhered to, is a thousand-tier/n-tier microservices application or a monolithic application more secure? [closed]

Assuming secure code practices are all adhered to for both applications, is a thousand-tier/n-tier microservices application or a monolithic application more secure? From a monitoring, visibility ...
1 vote
0 answers
59 views

A single microservice (e.g., a spring boot jar) can be dependent on more than 100 libraries - how to ensure that none of these are compromised? [duplicate]

It took only one DLL, the SolarWinds.Orion.Core.BusinessLayer.dll, to bring so many companies to the knees. To be more precise, just a couple lines of code in the single DLL. In today's cloud-native ...
3 votes
1 answer
1k views

Propagating user context between microservices secured with M2M JWT tokens

We have a current microservice architecture where we secure communication between microservices via Machine-To-Machine access tokens (these tokens are obtained using the Client Credentials grant flow)....
  • 151
0 votes
1 answer
216 views

In Microservice Architecture, how to secure inter service to service

In Microservice architecture, public clients & confidential clients are there as per API Gateway Pattern, Public clients connecting from Browser to backend reaches it via API Gateway API Gateway ...
0 votes
0 answers
75 views

How to prevent horizontal escalation attacks when a centralized authorization service as gateway is used?

Say I have a gateway which provides authorization mechanisms by validating a JWT, behind an api-gateway there are different micro-services but only the gateway port is public. As a software designer ...
1 vote
1 answer
403 views

Disable SSL verification between isolated microservices

I have an internet isolated EC2 instance which is a Ruby client and it is connecting with multiple EC2 servers of mine in the same network having different sub-domain names. These EC2 servers are ...
  • 113
1 vote
0 answers
77 views

Generate new AccessToken each time user update his Information

im building a PWA app , where i implemented jwt token to auth users. i have 2 main architecture problems ,but let me introduce you what im building . i'm Building application that is all about dog ...
0 votes
1 answer
468 views

Microservice security: How to perform authorization + services also need auth checks individually?

I have the following architecture for accessing a REST service that requires authentication: Oidc token flow managed at the client Access token verified at the server in the auth service (proxied ...
  • 327
3 votes
1 answer
297 views

Is it necessary to protect the Oauth2 return URL

I am thinking to implement a REST service that needs to call another REST service that is protected by OAuth2. My service is "always" called server to server by web applications. The user interacts ...