Questions tagged [microservices]
The microservices tag has no usage guidance.
14
questions
0
votes
0answers
18 views
Authenticating/ identifying dynamic UI Client to Back-End [duplicate]
The title may be a bit misleading so I will try to make this as clear as possible. We have several microservices that
expose endpoints and they communicate to each other. They needed to authenticate ...
1
vote
1answer
57 views
Error code prefixes specific to specific micro services a vulnerability?
If your microservice architecture responds with error codes revealing which microservice had an error, doesn’t this reveal to the caller information on how your microservice architecture is designed?
...
0
votes
1answer
199 views
Setting httponly secure cookies in microservice architecture
I have read that storing the jwt token within the httponly secure cookie is the recommended way to prevent both csrf attacks and xss attacks.
When a user goes to my website they may make an api call ...
2
votes
2answers
91 views
Access Control for REST APIs - OWASP recommendation
OWASP states:
Non-public REST services must perform access control at each API
endpoint. Web services in monolithic applications implement this by
means of user authentication, authorisation logic ...
2
votes
0answers
48 views
Assuming secure code practices are adhered to, is a thousand-tier/n-tier microservices application or a monolithic application more secure? [closed]
Assuming secure code practices are all adhered to for both applications, is a thousand-tier/n-tier microservices application or a monolithic application more secure?
From a monitoring, visibility ...
1
vote
0answers
56 views
A single microservice (e.g., a spring boot jar) can be dependent on more than 100 libraries - how to ensure that none of these are compromised? [duplicate]
It took only one DLL, the SolarWinds.Orion.Core.BusinessLayer.dll, to bring so many companies to the knees. To be more precise, just a couple lines of code in the single DLL.
In today's cloud-native ...
0
votes
0answers
43 views
client security separate from user context
Consider the following set up applications and services:
apps:
mycompany.com webapp
apis:
products api
orders api
mycompany.com's webapp uses OAuth2/openidconnect with an IdP (such as auth0) to ...
3
votes
1answer
640 views
Propagating user context between microservices secured with M2M JWT tokens
We have a current microservice architecture where we secure communication between microservices via Machine-To-Machine access tokens (these tokens are obtained using the Client Credentials grant flow)....
0
votes
1answer
74 views
In Microservice Architecture, how to secure inter service to service
In Microservice architecture, public clients & confidential clients are there
as per API Gateway Pattern, Public clients connecting from Browser to backend reaches it via API Gateway
API Gateway ...
0
votes
0answers
47 views
How to prevent horizontal escalation attacks when a centralized authorization service as gateway is used?
Say I have a gateway which provides authorization mechanisms by validating a JWT, behind an api-gateway there are different micro-services but only the gateway port is public. As a software designer ...
1
vote
1answer
239 views
Disable SSL verification between isolated microservices
I have an internet isolated EC2 instance which is a Ruby client and it is connecting with multiple EC2 servers of mine in the same network having different sub-domain names. These EC2 servers are ...
1
vote
0answers
51 views
Generate new AccessToken each time user update his Information
im building a PWA app , where i implemented jwt token to auth users.
i have 2 main architecture problems ,but let me introduce you what im building .
i'm Building application that is all about dog ...
0
votes
1answer
305 views
Microservice security: How to perform authorization + services also need auth checks individually?
I have the following architecture for accessing a REST service that requires authentication:
Oidc token flow managed at the client
Access token verified at the server in the auth service (proxied ...
3
votes
1answer
187 views
Is it necessary to protect the Oauth2 return URL
I am thinking to implement a REST service that needs to call another REST service that is protected by OAuth2.
My service is "always" called server to server by web applications.
The user interacts ...
