确保请求来自 docker-compose 网络中的另一个容器

Question

Sometimes simple task seems to be more complex. It's what I am facing right now.

I am developing an e-commerce API. The app has a microservice based architecture. So, Order , Product , Payment and Auth these are different microservices. Each has it's own database.

These microservices communicate each other over http restful apis . So If a user places an order it talk to payment microservice to get generated checksum so that he can make payment. Payment microservice talks to Order to place an order.

Order microservice places an order and returns details to payment. No problem.

But after placing order, Product quantity must be reduced. I don't have any API to reduce product quantity. I don't want to have one.

Because, a product is only can be modified by its supplier. Supplier, indeed, can alter his product, but for this he passes his jwt .

If I make an API to alter product quantity, anyone can hit the api and reduce the quantity.

So, one solution can be an API that is only accessible by microservices.

How can I know that the call is coming from a microservice?

Should I create some hash and pass it while interacting with other microservice?

Docker-compose.yml

    version: '3'
services:
  users:
    build: './users'
    ports:
      - '4001:3000'
    volumes:
      - './users:/src/'
  products:
    build: './products'
    ports:
      - '4002:3000'
    volumes:
      - './products:/src/'
  orders:
    build: './orders'
    ports:
      - '4003:3000'
    volumes:
      - './orders:/src/'
  payments:
    build: './payments'
    ports: 
      - '4004:3000'
    volumes: 
      - './payments:/src/'

Dockerfile

#User node js official image as a parent image
FROM node

ADD package.json /tmp/package.json

RUN cd /tmp && npm install

RUN mkdir -p /src && cp -a /tmp/node_modules /src/

COPY . /src

WORKDIR /src

RUN npm install

EXPOSE 3000

CMD npm start

Answer 1

I am going to give a more broader perspective to the problem.

What you are trying to do can be solved using RBAC(Role based access control) which any application which has different category of users and access permissions need. In your case by the description three category of users are present

1. Buyers
2. Suppliers
3. Administrator

Each category of users have different set of access permissions buyers least to Administrators all access.

The general idea is when the user authenticates it gets a token based on which group he belongs. The token contains access privileges. The token is passed on to all the subsequent api endpoints. The token defines what the user is capable of doing. So in your case if the product service has an endpoint to reduce quantity only Admin or supplier would have permission to do that. You can use OAuth based authorization framework.

References

• https://elang2.github.io/myblog/posts/2018-09-29-Role-Based-Access-Control-MicroServices.html
• https://dzone.com/articles/simple-secure-role-based-access-control-rbac-for-r