Search code examples
web-servicesarchitecturemicroservicesscalable

How to architect authenticate/authorise in microservice using JWT?


How to make a stateless architecture design so that if a user(A) is loggedIn and the Json web token is generated by Server(X1) and returned to user-A. And again user-A sends the request to server and the purpose is served by Server(X2) without making the user re-authenticate. So that the architecture is highly scalable horizontally.


Solution

  • Normally you would have a service that would do all the work related to authentication. Basically that means that X1 and X2 will call that service to authenticate user or verify existing authentication. The only thing that should be performed on X1 and X2 is validation of the token. Token could be valid, valid and expired or not valid. In case of it is valid, you just perform necessary work, regardless of particular server. If it is not valid, you reject request and if it is expired, you redirect user to reauthentication.

    But if you are asking about particular environment-specific details and your problem is that X2 does not have some specific cryptography keys that X1 has or something like this, then you forgot to mention what frameworks you are using to obtain JWT.