PRODUCT WITH COUPONS MICRO-SERVICES

KEY SECURITY CONCEPTS

Authetication

This is the process to know the application who we are. usually, we do authetication using the username and password and the application let us access inside.

Authorization

Once the user login to the application, authorization determine how much (i.e. functionalities) the user will have the acces to the app and what they would be allowed to perform.

Confidentiality

This ensures that the data being used is not breached by the hacker and we use encryption/ decryption to ensure the data confidentiality.

Integrity

This ensures that the data is not changed during the process of communication. We use signatures for ensuring the data integrity.

CSRF

This prevents another website to submit the data on our behalf.

CORS

This ensures that the application in different domains can communicate with each other without an issue.

figure: Spring security flow

figure: Spring security password based authetication flow

figure: Spring security authorization code based authetication flow

figure: Spring security client credentials based authetication flow

If we implemented the code using the JWT token signature, we dont need to make an extra request to the authetication server for the verification purpose. The toekn will include signature that would include the verification info.

OAUTH WITH JWT TOKEN

AUTHORIZATION CODE GRANT TYPE

CREATE THE PRIVATE AND PUBLIC KEY

keytool -genkeypair -alias jwtiscool -keyalg RSA -keypass jwtiscool -keystore jwtiscool.jks -storepass jwtiscool

keytool -list -rfc --keystore jwtiscool.jks | openssl x509 -inform pem -pubkey