Okay, so our software is a cluster of many small and isolated services, it all looks good but the authentication monster is always lurking and ready to complicate our lives.
Indeed in such a varied galaxy being able to manage permissions for each user seems an impossible task or at least too slow to be handled efficiently.
Fortunately, an ingenious authentication technique has been invented that goes by the name of JWT. As soon as you understand how it works, you will not be able to do without it; in fact, you will probably use it in every one of your projects even if it is not microservices-based.
The classic authentication process involves opening a session at login but in this case it is impossible to talk about a working session since each service is by definition being isolated.
Ok, so let’s start by giving the user a token and passing each web call this token between the request headers. In this way it will be possible to derive the user’s role from the token itself.
But how? by passing the token to the authentication service? sure. obviously I will have to deal with an exponential workload running the risk of having a resource-eating monster on my hands.
The easiest way is to make sure that the token itself contains the user role information without having to look elsewhere for it.
What about security? This is precisely where JWT shows all its brilliance.
the token is a string divided into three parts (the dot divides the parts):
- the first part contains in base64 the information about the encryption algorithm I use
- the second part contains my role and any other information completely in plain text.
- the third part contains the same previous information (1+2) but encrypted with a private key.
Each service will be able to use the information contained in the second part to manage the user’s permissions. simple, trivial — but who guarantees me that the data will not be corrupted?
I will simply pass the token to the authentication service, which through its private key can understand whether or not the data has been corrupted. But the speed of this check will be dramatically faster than a dbase search because it will require a simple and trivial application of the private key.
If then this check were to be done automatically by a service gateway that would raise a blocking error in the event of corruption…here is guaranteed absolute security and at the same time incredible simplicity of security role management.
As if this simplicity were not enough, in full microservice logic an extremely complete and efficient online service (besides being free for a certain number of users) was created to manage:
- registration
- login
- password recovery
- role management
- brute force control
Its name is Auth0 and it will allow us to have a complex user system in very few minutes. Then, if you want JWT you can use it in any kind of architecture although its natural place is with microservices
On the jwt.io site you can find a very handy jwt javascript processor to quickly test your jwt token and to check by private key its authenticity
From the image above you can easily recognize the three parts of the token:
in red the encryption algorithm
in purple the plaintext data
in blue the first and the second encrypted part: to check its authenticity just put the private key
Top comments (0)