ToolypetMCP
advanced6 minutescross hub

Microservice Security Scaffold

Secure a microservice: generate service-to-service JWT, set up mTLS certificates, configure API gateway headers.

microserviceservice-meshmtlsjwtapi-gateway

何时使用此配方

Secure microservice architectures with defense in depth: JWT for identity, mTLS for transport, HMAC for request integrity, and CORS at the gateway.

步骤

1

Secret Generator

试用此工具

Per-service secrets

提示词:Generate unique secrets for each microservice: auth-service, user-service, payment-service
2

JWT Generator

试用此工具

Service JWT tokens

提示词:Generate a service-to-service JWT with claims {iss: 'auth-service', aud: 'user-service', scopes: ['read:users']}
3

RSA Key Generator

试用此工具

Generate mTLS keys

提示词:Generate RSA key pairs for each service for mTLS (mutual TLS) authentication
4

CORS Generator

试用此工具

API gateway CORS

提示词:Generate CORS for API gateway: allow only known frontend origins, restrict methods per service
5

HMAC Generator

试用此工具

Request signing between services

提示词:Generate HMAC signatures for inter-service request verification as a secondary auth layer

常见问题

JWT vs mTLS for service-to-service auth?

Use both. mTLS verifies the service identity at the transport layer (which server is calling). JWT carries authorization claims (what the service is allowed to do). Defense in depth.

Do microservices need CORS?

Not between backend services (they communicate directly). CORS is needed at the API gateway/BFF layer where browser clients connect. Internal services should reject all browser requests.

相关配方