Secure your Modular Monolith by pretending it's a cat
summary
Advocates including user identity on every internal message, implemented in the mediator pipeline so messages that leave process sign messages with private key and recipients validate by key ID; sensitive fields get encrypt payload with recipient public key or attribute-level encryption tied to roles for personalization. Protect against expired JWTs via token exchange or internal long-lived service tokens hashed with the message ID to prevent replay. Rotate credentials frequently using HashiCorp Vault for dynamic credentials and include key IDs for versioning.
AI-written summary · about
chapters (10)
- 0:00Introduction and context
- 5:19Understanding modular monoliths
- 10:24Tracking user identity
- 12:50Zero trust messaging
- 19:45Securing message content
- 23:10Preventing message loss
- 25:55Data personalization
- 29:53Handling token expiration
- 36:21Versioning and key rotation
- 40:03Recap and concluding remarks
related talks
50mSecure your Modular Monolith by pretending it's a cat
40mSecure your Modular Monolith by pretending it's a cat
01h 06mMicroservice Authentication and Authorization
38mAuthentication as a Microservice: Portable Customer Identity Management
39mManaging Trust Between Multiple Clouds and Non-human Identities Without Passwords
01h 02mLock That Sh*t Down! Auth Security Patterns for Apps, APIs, and Infra
01h 00mInsecure Transit - Microservice Security
56mLock That Sh*t Down!