Securing communication between microservices means ensuring every service-to-service call is authenticated, authorized, and encrypted, since internal network traffic can't be assumed to be safe by default.
Key Points: • OAuth2 combined with JWT tokens handles authentication and authorization, letting each service validate that a caller is legitimate and has the right scope for the request. • All traffic should run over HTTPS so data in transit is encrypted, preventing eavesdropping even on internal networks. • Mutual TLS (mTLS) goes a step further by having both sides of a connection present certificates, so each service verifies the other's identity, not just the client verifying the server. • A service mesh like Istio or Linkerd can enforce mTLS and fine-grained access policies transparently, without changing application code. • Tokens should carry minimal necessary scope and have short expiration times to limit the damage if one is ever compromised.
Example: A request from the Order Service to the Payment Service would carry a JWT issued by an identity provider, travel over an HTTPS connection secured with mTLS via a service mesh sidecar, and be rejected by the Payment Service if the token's scope doesn't include "payment:write".
Interview Tip: A concise interview answer is:
"I secure inter-service communication with OAuth2 and JWTs for authentication and authorization, HTTPS to encrypt data in transit, and mutual TLS so both sides of a connection verify each other's identity, not just the client trusting the server. A service mesh can enforce mTLS and access policies consistently without every team having to implement it themselves."