Microservice Authentication and Authorization
summary
Argues for a zero‑trust microservice posture: use signed JWTs with audience exp nbf and jti checks, validate algorithm explicitly to avoid the "alg=none" and RSA→HMAC attacks, and prefer short TTL ID tokens with refresh tokens plus a blacklist for revocation. Demonstrates concrete tooling: HashiCorp Vault for OTP, PKI cert issuance, transit signing, and recommends TLS/MTLS between services, message signing for queues, and key rotation to prevent replay and lateral‑movement after breaches (noting ~5 billion breached credentials and 1.4B plain passwords).
AI-written summary · about
chapters (36)
- 0:00Introduction
- 3:49Authorization
- 4:10Application Flow
- 8:17Evil Alice
- 10:37Every request is hostile
- 11:52How do we do this
- 12:15OpenID Connect
- 12:50Water
- 13:17Example
- 16:52The problem with OAuth
- 17:33OAuth Connect
- 19:05JSON Format
- 19:19JSON Object
- 19:52JSON Form
- 22:48Payload
- 26:46Public Claims
- 27:39Private Claims
- 29:26Signatures
- 32:44Algorithms
- 34:36Disclaimer
- 35:31Headers
- 35:47Key ID
- 36:43Web Encryption
- 37:49No Way Jose
- 38:34EvilAlice
- 42:20Best Practices
- 43:31Passwords
- 43:57Why should you care
- 44:40Plain text document
- 45:11Password dictionary
- 46:04Twofactor authentication
- 48:40Message queue vulnerability
- 50:35Message signing
- 53:33Using Vault
- 54:49Summary
- 57:55Thank you
related talks
38mAuthentication as a Microservice: Portable Customer Identity Management
01h 02mPractical Microservice Security
19mOAuth and OpenID Connect for Microservices
57mHow Do I Secure My Micro-Services?
51mInsecure Transit - Microservice
39mMicroservice Security via MicroProfile JWT
01h 00mInsecure Transit - Microservice Security
51mAppSec and Microservices