ToolypetMCP
advanced6 minutescross hub

Microservice Security Scaffold

Secure a microservice: generate service-to-service JWT, set up mTLS certificates, configure API gateway headers.

microserviceservice-meshmtlsjwtapi-gateway

इस रेसिपी का उपयोग कब करें

Secure microservice architectures with defense in depth: JWT for identity, mTLS for transport, HMAC for request integrity, and CORS at the gateway.

चरण

1

Per-service secrets

प्रॉम्प्ट:Generate unique secrets for each microservice: auth-service, user-service, payment-service
2

Service JWT tokens

प्रॉम्प्ट:Generate a service-to-service JWT with claims {iss: 'auth-service', aud: 'user-service', scopes: ['read:users']}
3

Generate mTLS keys

प्रॉम्प्ट:Generate RSA key pairs for each service for mTLS (mutual TLS) authentication
4

API gateway CORS

प्रॉम्प्ट:Generate CORS for API gateway: allow only known frontend origins, restrict methods per service
5

Request signing between services

प्रॉम्प्ट:Generate HMAC signatures for inter-service request verification as a secondary auth layer

अक्सर पूछे जाने वाले प्रश्न

JWT vs mTLS for service-to-service auth?

Use both. mTLS verifies the service identity at the transport layer (which server is calling). JWT carries authorization claims (what the service is allowed to do). Defense in depth.

Do microservices need CORS?

Not between backend services (they communicate directly). CORS is needed at the API gateway/BFF layer where browser clients connect. Internal services should reject all browser requests.

संबंधित रेसिपी