Securing a microservices architecture is harder than securing a monolith because authentication, authorization, and data protection must be enforced consistently across many independently deployed services and the network links between them.
Key Points: • Every service-to-service call is a potential attack surface, so authentication and authorization need to be verified at each hop, not just at the edge. • Data in transit between services must be encrypted, typically with TLS, to prevent interception on internal networks. • OAuth2 with JWT access tokens lets services validate a caller's identity and scopes without a central session store, propagating the token through the call chain. • Mutual TLS (mTLS) has each service present a certificate to the other, so both sides authenticate each other, commonly implemented via a service mesh like Istio. • An API Gateway enforces coarse-grained policies like rate limiting and request validation at the perimeter, while fine-grained authorization still needs to happen inside each service.
Example: In an OAuth2 setup, a client authenticates once with an identity provider like Keycloak, receives a JWT, and that token is forwarded on every downstream call; each service independently validates the token's signature and scopes before processing the request.
Interview Tip: A concise interview answer is:
"The main challenge is that trust has to be established at every service boundary instead of just once at the edge. I'd use OAuth2 with JWTs for service-to-service authentication and authorization, mutual TLS to encrypt and authenticate traffic between services, and enforce coarse security policies like rate limiting at the API gateway while each service still validates tokens independently."