Questions tagged [microservices]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
1answer
36 views

Error code prefixes specific to specific micro services a vulnerability?

If your microservice architecture responds with error codes revealing which microservice had an error, doesn’t this reveal to the caller information on how your microservice architecture is designed? ...
0
votes
1answer
72 views

Setting httponly secure cookies in microservice architecture

I have read that storing the jwt token within the httponly secure cookie is the recommended way to prevent both csrf attacks and xss attacks. When a user goes to my website they may make an api call ...
2
votes
2answers
71 views

Access Control for REST APIs - OWASP recommendation

OWASP states: Non-public REST services must perform access control at each API endpoint. Web services in monolithic applications implement this by means of user authentication, authorisation logic ...
2
votes
0answers
38 views

Assuming secure code practices are adhered to, is a thousand-tier/n-tier microservices application or a monolithic application more secure? [closed]

Assuming secure code practices are all adhered to for both applications, is a thousand-tier/n-tier microservices application or a monolithic application more secure? From a monitoring, visibility ...
1
vote
0answers
55 views

A single microservice (e.g., a spring boot jar) can be dependent on more than 100 libraries - how to ensure that none of these are compromised? [duplicate]

It took only one DLL, the SolarWinds.Orion.Core.BusinessLayer.dll, to bring so many companies to the knees. To be more precise, just a couple lines of code in the single DLL. In today's cloud-native ...
0
votes
0answers
32 views

client security separate from user context

Consider the following set up applications and services: apps: mycompany.com webapp apis: products api orders api mycompany.com's webapp uses OAuth2/openidconnect with an IdP (such as auth0) to ...
2
votes
1answer
431 views

Propagating user context between microservices secured with M2M JWT tokens

We have a current microservice architecture where we secure communication between microservices via Machine-To-Machine access tokens (these tokens are obtained using the Client Credentials grant flow)....
0
votes
1answer
56 views

In Microservice Architecture, how to secure inter service to service

In Microservice architecture, public clients & confidential clients are there as per API Gateway Pattern, Public clients connecting from Browser to backend reaches it via API Gateway API Gateway ...
0
votes
0answers
35 views

How to prevent horizontal escalation attacks when a centralized authorization service as gateway is used?

Say I have a gateway which provides authorization mechanisms by validating a JWT, behind an api-gateway there are different micro-services but only the gateway port is public. As a software designer ...
1
vote
1answer
181 views

Disable SSL verification between isolated microservices

I have an internet isolated EC2 instance which is a Ruby client and it is connecting with multiple EC2 servers of mine in the same network having different sub-domain names. These EC2 servers are ...
1
vote
0answers
43 views

Generate new AccessToken each time user update his Information

im building a PWA app , where i implemented jwt token to auth users. i have 2 main architecture problems ,but let me introduce you what im building . i'm Building application that is all about dog ...
0
votes
1answer
271 views

Microservice security: How to perform authorization + services also need auth checks individually?

I have the following architecture for accessing a REST service that requires authentication: Oidc token flow managed at the client Access token verified at the server in the auth service (proxied ...
3
votes
1answer
150 views

Is it necessary to protect the Oauth2 return URL

I am thinking to implement a REST service that needs to call another REST service that is protected by OAuth2. My service is "always" called server to server by web applications. The user interacts ...