Protecting microservices with Spring Cloud Security

In a monolithic web application, once the user is logged in, user-related information will be stored in an HTTP session. All subsequent requests will be validated against the HTTP session. This is simple to manage, since all requests will be routed through the same session, either through the session affinity or offloaded, shared session store.

In the case of microservices, it is harder to protect from unauthorised access, especially, when many services are deployed and accessed remotely. A typical or rather simple pattern for microservices is to implement perimeter security by using gateways as security watchdogs. Any request coming to the gateway will be challenged and validated. In this case, it is then important to ensure that all requests to downstream microservices are funneled through the API Gateway. Generally, the load balancer sitting in the front will be the only client that sends requests to the gateway. In this approach, downstream...