CODEWITHSUNDEEP
apijwtmicroserviceskongapi-gateway
Yaya
Yaya

Reputation: 268

APIs authentication and JWT token validation with KONG

I plan to use Kong in our project. I'm currently working on a POC to see how we can integrate it in our platform as the main API gateway. I also want to use the JWT plugin for authentication and authorisation. I know that all the API calls should go through the Kong gateway to be authenticated. Then, if the authentication is validated they can go to the API.

Clients ---> Kong gateway ----> Apis

The part that is not very clear in my mind is how the APIs and Kong fit together.

  1. Imagine a scenario where a client try to call directly an API with a token (bypassing the Gateway). How can the API use Kong to validate this token ?

  2. How does Kong authenticates the APIs (not the Client) ? In the examples I have seen so far, only the authentication of the clients is documented, not the authentication of the APIs that are "protected" by Kong.

Upvotes: 1

Views: 2502

Answers (1)

Anunay
Anunay

Reputation: 1893

When using kong as an API Gateway (or for that matter any gateway) we tend to put it at the point where external clients talk to your service. It is a means to discover the individual services. And kong can do good enough job to validate such request.

For the calls you make to other services from within your set of microservices, you may allow for the free passage by means of directly invoking the service. Challenge in that case will be how the services will discover each other. (One way is to rely on DNS entries. We used to do that but later moved to kubernetes and started using their service discovery), and restrict all the incoming traffic to a given service from outside world. So they can only get in via gateway (and thats where we have all the security)

The reason behind the above philosophy is that we trust the services we have created (This may or may not be true for you and if its not then you need to route all your traffic via an api gateway and consider your APIs as just another client and they need to get hold of access token to proceed further or may be have another service discovery for internal traffic)

Or you may write a custom plugin in kong that filters out all the traffic that originates from within your subnet and validates everything else.

Upvotes: 1

Related Questions