Microservices Pattern

Token-Based Auth (JWT)

Use signed tokens to propagate identity and authorization claims.

auth

Detailed Description

JWTs work well for stateless identity propagation.

Use short expirations, key rotation, and careful claim design.

Visual Diagram

JWT Flow
  Client → POST /auth/login
  AuthSvc → signs JWT { userId, roles, exp }
  Client → sends JWT in Authorization header
  ServiceA → verify signature locally ✓
  ServiceA → extract userId, roles from payload
  Stateless — no session store needed

Tradeoffs

Pros

Stateless validation, works across services

Cons

Revocation and claim freshness are hard

Examples: jsonwebtoken, jose, Auth0, Keycloak, Cognito

Comments

Loading comments...