微服务中的身份验证

Question

I am developing a microservice system for my company using ASP.NET Core. But a have faced with the following problem: when authenticated user is requesting some service, how should it check if the token is an actual (not blacklisted). I mean the case when user takes a new token but his old token is not expired yet thus the last one is an actual and could be used for accessing the resource services. So I gonna make all ofthe microservices ask the authentication service whether the token is an actual at each request. Perhaps there are any elegant ways to do it?

Answer 1

If you want to make sure that the token is valid and current on every request then you will have to ask the data source (your Authentication Provider) for that information on every request.

This can be done in a middleware so that your main code can stay clean.

Answer 2

There are two approaches you could take based on your services.

If a service is called very frequently let him cache the token (not in the core code, but some layer above) and listen for user login logout updates, in this case worst could happen is even after logout user can call this service for a very small period of time(time between syncing)

Also in this case multiple services could use the same cache on (memchahe or like)

If a service is called less frequently or require very high consistency call every time for consistency check.

Answer 3

This is an expected behaviour when making use of tokens.Tokens once created need no further check(other than verifying the signature) and this is perhaps why they are good as they minimize the validation call to Authentication Provider each and every time a service is invoked.

Tokens should be created for the smallest of duration with the TTL being as small as possible for you. In microservices this time can be kept to as small couple of minutes to may be five minutes (Every five minutes you can refresh your token). This should be enough for most applications as long as you do due diligence to keep the token safe when passing from one service to another

If however its critical for you to make sure that no unintended use of tokens is their, you should rest that responsibility with Authentication Provider itself. Anyone else in between do not have the authority to validate the token.