Senior Quiz: Microservice Security¶

Network location is not identity. Prefer verifiable tokens or workload identity; if trusted headers are used, authenticate the intermediary and prevent direct or injected access.

Exchange can constrain delegation and reduce blast radius. It is not a mechanism for silently amplifying privilege or lifetime.

Client Credentials represents the client itself. If a decision depends on the user, use a designed delegation mechanism rather than inserting an unverified username header.

Transport or workload identity does not replace endpoint, scope, tenant, ownership, or replay authorization.

Tenant and issuer resolution must start from server-controlled trusted configuration. Parse unverified data only to select among an allow-listed set, never to create trust dynamically.

API keys should be handled like passwords. Recoverability increases breach impact; a prefix supports lookup and operations without storing the credential.

The service with authoritative resource context must enforce the decision. Gateways generally lack current ownership and domain state.

Long-lived protocols require explicit expiry, revocation, destination authorization, and authority-change behavior.

API keys are long-lived credentials. Treat them like passwords: hash the stored value, limit scope, rotate, and never log the secret.

A catch-all anyRequest chain should be published last, or each chain should be scoped with securityMatcher to a specific request set. Otherwise more specific chains become unreachable.

Delegation must be based on verified, signed claims checked against an explicit trust decision — not on the mere presence of a claim or an unauthenticated header.

Tenant identity must come from a verified token, and the right trust material must be selected before the signature is validated.

The salt defends precomputed rainbow attacks but is not itself a secret. Security comes from not storing the original credential and from using a slow, salted hash.

Object authorization enforces ownership within a tenant. Same-tenant administrators may be granted an override, but ordinary users cannot access each other's objects.

Field-level method security isolates the denial to the protected field. Other fields still resolve, and the client sees the error in the GraphQL errors array.

mTLS requires the client to present a certificate. A TLS-only transport protects confidentiality but does not authenticate the caller.