I haven’t seen any articles on this topic, so I’m wondering how would I secure my methods when using @Incoming and @Outgoing in a Quarkus application?

In a regular REST application I’d use the @RolesAllowed, but that doesn’t work when doing Messaging with RabbitMQ, etc?

I am surprised that no videos talk about making sure only certain groups/roles can actually execute the code when an event is received from an event bus. I’m not talking about who can actually connect to the server, but who can execute code in a message receiver method.

Is this a valid request? or does everyone assume an API gateway will take care of everything INTO the system and not care about security between services BEHIND the gateway?

I’m just thinking about any potential roque employees, etc.. not that we have any but always thinking “what-if”

I’m assuming to support it, we’d need to pass in a JWT token and manually validate it in the request event message or something like that.

Thanks!