Using JWT authentication to secure the service endpoints
In token-based authentication, the user state is stored at the client side. When a client logs in to the server, the server encrypts the user data into a token with a secret and sends it back to the client. Any subsequent user requests must have this token set in the request header. The server retrieves the token, validates the authenticity, and resumes the user session:
Figure 4.9 – Token-based authentication
As shown in the preceding diagram, in a token-based authentication strategy, the client does the heavy lifting of keeping track of the session in the JSON web token. A client must provide a valid token to resume the session.
To learn how to secure a microservice using token-based authentication, we will work on a hands-on pet-clinic microservice. To begin, we will set up a third-party identity provider using Keycloak. In the next section, we will set up Keycloak locally.