Assuming any user with a JWT has access to all microservices can't you just validate a JWT within the API Gateway and be done. Then passing the request to the microservices without any further auth.
@libby66369 ай бұрын
No really. Actually, the privilege authorization happens after the process of authentication. We can encode the access limitation specific logic in this phase, and these two processes mentioned above can be done at the API gateway layer.
@libby66369 ай бұрын
In addition, the privileges required for a specific action or resource can be synchronized to the API Gateway, we can easily compare the privileges decrypted from the JWT with that from other micro services to implement our own access control logic.
@jakubzaplatilek31723 ай бұрын
"we trust each other" in "zero trust" arch is kind of funny