Search code examples
securityoauth-2.0jwtmicroservicesrefresh-token

Will this Authentication/Authorization Architecture for Microservices work?

I'm designing a microservices-based architecture. The architecture should support multiple devices accessing the API.

In order to secure the internal Resource APIs, I wanted to implement authentication and authorization based on JWTs and Refresh Tokens.

My requirements are:

  1. Preventing an attacker from using XSS to steal the user's token
  2. Preventing CSRF attacks
  3. In-bounds security: even if the attacker can send requests to the internal Resource APIs, he can't do anything without a signed JWT
  4. Managing users (Authentication and Permissions) via a single internal Users API
  5. The tokens can be revoked at any time
  6. Support Multi-Factor Authentication via TOPT

This is what I came with:

enter image description here

Few details:

  1. The JWTs are really short-lived (30 seconds)
  2. The Internal API Gateway will include an endpoint (login) for converting username, password, and TOPT passcode to a new refresh token via the Users API.

Will this architecture actually work? will it be secure? Thank you very much! 😊

Solution

  • Tokens are actually harder to secure from JavaScript than pure cookies that we have several mature ways to protect from JavaScript (like Secure, HttpOnly, SameSite...).

    I think you should keep your architecture less complex by using the same technique everywhere for both mobile and browsers. As both types are considered to be insecure public clients.

    also, a hint, it can be interesting for you to explore how existing application deal with this using a tool like Fiddler to capture all the mobile traffic and explore how they deal with login, session and signout.

    see https://docs.telerik.com/fiddler/configure-fiddler/tasks/configureforios