Authentication vs Authorization

• Authentication → Who are you? (identity)

• Authorization → What can you access? (permissions)

🔹 Challenge in Microservices

• Multiple services

• Stateless REST APIs

• Shared security logic

• Avoid session replication

👉 Solution: Token-based security (JWT + OAuth2)

🔹 OAuth2 (High-Level)

OAuth2 is a delegation framework:

• User authenticates once

• Gets an access token

• Token is used to access services

📌 Components:

• Authorization Server

• Resource Server (Microservices)

• Client (UI / App)

🔹 JWT (JSON Web Token)

JWT is a self-contained token that includes:

• User info

• Roles

• Expiry

• Signature

📌 Structure:

🔹 Authentication Flow (Step-by-Step)

1. User logs in

2. Auth Server validates credentials

3. Auth Server generates JWT

4. Client sends JWT in Authorization header

5. API Gateway validates token

6. Request forwarded to microservice

7. Microservice authorizes based on roles

🔹 Where Security Logic Lives?

🔹 Spring Security Example

🔹 Advantages

✅ Stateless
✅ Scalable
✅ No session storage
✅ Works well with microservices

🔹 Challenges

❌ Token revocation is hard
❌ Token expiry handling
❌ Key rotation

🔹 Best Practices

• Short-lived access tokens

• Refresh tokens

• Validate JWT at API Gateway

• Use HTTPS always

⭐ Interview One-Liner

“Microservices typically use OAuth2 with JWT for stateless, scalable authentication and role-based authorization.”

🔹 Follow-Up Questions

• JWT vs Session?

• How do you revoke JWT?

• Where do you store refresh tokens?