Microservice Security via MicroProfile JWT
summary
MicroProfile JWT replaces per-request basic auth so backend microservices stop hitting LDAP/databases for every call: a demo on Apache TomEE processes 3,000 TPS from 1,000 users (3 req/sec) calling four services each, validates RSA-signed JWTs in CPU/memory, and uses short-lived access tokens plus refresh-token revocation to limit state. Code shows MP JWT config (issuer + public key), injecting JsonWebToken and @Claim, and enforcing @RolesAllowed; the demo token issuance and validation flow runs end-to-end.
AI-written summary · about
chapters (7)
- 0:00Start
- 2:16Baseline Architecture
- 2:49Basic Auth Message
- 4:58The theory behind it
- 5:34OAuth 2 - Password Grant
- 10:47JSON Web Token
- 23:36What implementations?
related talks
51mStateless Microservice Security via JWT, TomEE and MicroProfile
38mSecure Microservices Made Easy with MicroProfile JWT
46mSecure microservices made easy with MicroProfile JWT
01h 06mMicroservice Authentication and Authorization
38mAuthentication as a Microservice: Portable Customer Identity Management
47mDeconstructing and Evolving REST Security
57mSecuring Microservices with Auth0 and MicroProfile in Kubernetes without a hassle
42mMicroProfile: microservices made easy