Securing the Service to Service Call Chain Patterns and Protocols
summary
Covers concrete patterns and tradeoffs for propagating user and service identity across polyglot services using Spring demos and a GitHub repo with implementations. Compares API Gateways versus direct framework approaches, shows Service Mesh and SPIFFE for automatic mTLS certificate injection, contrasts token relay with token exchange, and recommends platform-injected identity (Kubernetes CSI, Cloud Foundry instance certs) over app‑requested secrets. Uses Spring Authorization Server, Spring Cloud Gateway, Spring Session; demos compile and run though full Kubernetes variants are still landing in the repo.
AI-written summary · about
chapters (9)
- 0:00Service-to-service security challenges
- 4:57Service vs user identity
- 8:06Polyglot services with protocols
- 9:31TLS for secure channels
- 12:21OpenID Connect & WebAuthn
- 19:26Platform tokens for identity
- 29:04Propagating user identity
- 33:17Spring tools for patterns
- 41:51Service mesh evaluation
related talks
46mImplementing Microservices Security Patterns & Protocols with Spring Security
50mArchitectural Patterns for Spring Security You Wish Your Tech Lead Knew
41mSecurity Patterns for Microservice Architectures
23mMicroservice Security at the API Level
31mAuthentication and Security in gRPC Microservices
01h 30mSecuring Microservices with Spring Cloud Security
10mService Mesh Security in a Nutshell
59mArchitectural Patterns Focus: Security