Securing service endpoints using session authentication
In session-based authentication, the user state is stored at the server side. When a user logs in to the server, the server starts the session and issues a session ID in a cookie. The server uses the session ID to uniquely identify a session from the session quorum. Any subsequent user requests must have this session ID passed as a cookie to resume the session:
Figure 4.3 – Session-based authentication
As shown in the preceding figure, in a session-based authentication strategy, the server does the heavy lifting of keeping a track of the session. A client must provide a valid session ID to resume the session.
To learn how to secure a microservice using session-based authentication, we will experiment on the pet-owner microservice. To begin, we will need to enable security by adding the following dependencies to the pom.xml project:
<!-- Micronaut security --> ...