英文:
Each microservice has to implement authentication and authorization or it's better one centerized to deal with it?
问题
这个问题不是关于如何保护微服务（如何使用Oauth2或JWT），而是关于如何更好地处理它的策略。
我们应该选择什么？如果有其他建议，欢迎提出！
- 将身份验证和授权服务（AuthService）与微服务隔离开来：
微服务在处理请求之前必须调用AuthService（类似于中间件）。 - 微服务必须自行进行身份验证和授权。
- AuthService始终接收调用并将其传递给微服务（类似于网关）。
- 实现一个用于前端的后端（BFF），并自行进行身份验证和调用其他微服务。
最后一个选项，有些朋友提到过，但是...如果你需要扩展1或2个微服务，那么你也必须垂直扩展BFF。这对我来说有点奇怪。
英文:
This question is not about what use to securing the microservices like Oauth2 or JWT, but what is better strategy for deal it with it.
What should we choose? Please, if has another tip will be welcome!
- An authentication and authorization service (AuthService) isolated out of microservices:
Microservice must call AuthService before process the request. (like a Middleware) - Microservice has to do its own authentication and authorization.
- The AuthService always recieves the calls and do the transference for microservice (like a Gateway)
- Implement a Backend For Frontend (BFF) and itself do it auth and calls for the others microservices.
This last one, some friend have talked about to me buuut... On case that you have to scaling 1 or 2 microservices, you have to scaling vertically the BFF too. That's a weird to me.
答案1
得分: 1
通常，身份验证和授权是在微服务级别进行的。但身份验证服务/数据库应该位于微服务外部，并且内部，以启用缓存以减少对身份验证服务的调用并减少API延迟。
英文:
Normally authentication and authorization is at microservice level. But authentication service/database should be outside and internal to microservice, enable cache to minimise calls to Auth service and to minimise API latency.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论