I am currently working with two separate microservices: a User Service and an Authentication (Auth) Service.
-
User Service: Handles all user-related operations, including storing user data and password hashes.
-
Auth Service: Manages authentication processes like login, where I need to validate the user’s password and generate a JWT token upon successful login.
Problem:
In my current setup, the login API resides within the Auth Service, which requires password validation as part of the JWT token generation process. Since the User Service stores the password hash, the Auth Service needs to retrieve it from there in order to perform the validation.
However, exposing the password hash through the User Service is a security risk, as sending the password hash between services could potentially lead to vulnerabilities.
My Dilemma:
I need to securely validate the password within the Auth Service without directly exposing the password hash from the User Service.
Question:
How can I design this system to maintain secure communication between the User Service and Auth Service without exposing sensitive information like the password hash?
What best practices or patterns should I follow to securely implement password validation and token generation in this kind of microservices architecture?
1