Questions tagged [microservices]
The microservices tag has no usage guidance.
11
questions
2
votes
0answers
36 views
Assuming secure code practices are adhered to, is a thousand-tier/n-tier microservices application or a monolithic application more secure? [closed]
Assuming secure code practices are all adhered to for both applications, is a thousand-tier/n-tier microservices application or a monolithic application more secure?
From a monitoring, visibility ...
1
vote
0answers
52 views
A single microservice (e.g., a spring boot jar) can be dependent on more than 100 libraries - how to ensure that none of these are compromised? [duplicate]
It took only one DLL, the SolarWinds.Orion.Core.BusinessLayer.dll, to bring so many companies to the knees. To be more precise, just a couple lines of code in the single DLL.
In today's cloud-native ...
0
votes
0answers
32 views
client security separate from user context
Consider the following set up applications and services:
apps:
mycompany.com webapp
apis:
products api
orders api
mycompany.com's webapp uses OAuth2/openidconnect with an IdP (such as auth0) to ...
2
votes
1answer
149 views
Propagating user context between microservices secured with M2M JWT tokens
We have a current microservice architecture where we secure communication between microservices via Machine-To-Machine access tokens (these tokens are obtained using the Client Credentials grant flow)....
0
votes
1answer
54 views
In Microservice Architecture, how to secure inter service to service
In Microservice architecture, public clients & confidential clients are there
as per API Gateway Pattern, Public clients connecting from Browser to backend reaches it via API Gateway
API Gateway ...
0
votes
0answers
32 views
How to prevent horizontal escalation attacks when a centralized authorization service as gateway is used?
Say I have a gateway which provides authorization mechanisms by validating a JWT, behind an api-gateway there are different micro-services but only the gateway port is public. As a software designer ...
0
votes
0answers
48 views
JWT Propagation Across Services
I am looking into using OpenID Connect as a means of authentication across potentially multiple microservices. Consider the following chain of events:
Client successfully obtains an access token, ...
1
vote
1answer
132 views
Disable SSL verification between isolated microservices
I have an internet isolated EC2 instance which is a Ruby client and it is connecting with multiple EC2 servers of mine in the same network having different sub-domain names. These EC2 servers are ...
1
vote
0answers
42 views
Generate new AccessToken each time user update his Information
im building a PWA app , where i implemented jwt token to auth users.
i have 2 main architecture problems ,but let me introduce you what im building .
i'm Building application that is all about dog ...
0
votes
1answer
236 views
Microservice security: How to perform authorization + services also need auth checks individually?
I have the following architecture for accessing a REST service that requires authentication:
Oidc token flow managed at the client
Access token verified at the server in the auth service (proxied ...
3
votes
1answer
125 views
Is it necessary to protect the Oauth2 return URL
I am thinking to implement a REST service that needs to call another REST service that is protected by OAuth2.
My service is "always" called server to server by web applications.
The user interacts ...