Microservices face significant security challenges due to their distributed nature and larger attack surface, making them more vulnerable than monolithic applications. Effective strategies such as using OAuth for user access control and implementing an API gateway can help secure microservices by centralizing access and screening requests for security issues. Additionally, JWT (JSON Web Token) can be utilized for token-based authentication, ensuring the integrity and legitimacy of API requests.

1. Microservices Security

2. Security concerns in microservices
• Microservices are usually widely distributed systems with a larger
attack surface.
• Due to the large number of APIs, ports, and components that
are exposed traditional firewalls may not provide adequate security.
• Securing microservices are harder than monolithic applications

3. Strategies to secure microservices
• OAuth is one of the most effective strategies for user identity and
access control.
• Create a single and secure entry point (API gateway) that helps you
to centralize all access from external systems and clients.

4. API Gateway
• Screen all incoming requests for security issues before routing them to
the appropriate microservices.
• API gateway sits between the client applications and the microservices
• API gateway might also implement security, e.g. verify that the client is
authorized to perform the request
• API gateway helps to prevent malicious attacks by providing an additional
layer of protection from attack vectors such as SQL Injection, XML Parser
exploits, and denial-of-service (DoS) attacks.

6. Spring
Security with
JWT (JSON
Web Token)
Authorize an API request using a token
based authentication
Once the user is logged in, each
subsequent request will include the JWT
The user agent sends the JWT, typically
in the Authorization header using
the Bearer schema - Authorization:
Bearer <token>

7. JWT Structure
• Header (contains type of token and signing algorithm)
• Payload (contains claims that are statements about the
user)
• Signature (verify the message wasn't changed along the
way)
A JWT typically looks like
• xxxxx.yyyyy.zzzzz

9. Thank you!