BFF to microservice: client credentials or token-forwarding [closed]

Question

Closed. This question is opinion-based. It is not currently accepting answers.

Want to improve this question? Because this question may lead to opinionated discussion, debate, and answers, it has been closed. You may edit the question if you feel you can improve it so that it requires answers that include facts and citations or a detailed explanation of the proposed solution. If edited, the question will be reviewed and might be reopened.

Closed 3 months ago.

Improve this question

I currently have an admin console that is served a BFF layer and 2 REST microservices - product microservice and user microservice. The user microservice stores information on login users as well as their permissions e.g. which products they are allowed to see, modify, etc. All of this is hosted on AWS.

I am not sure how to design the authentication workflow (using AWS Cognito). I have thought of 2 solutions, but am not sure which is better, or if either are even ideal.

Solution 1:

FE user signs in via Cognito and performs an action -> FE sends token to BFF -> BFF accesses user service using client credentials to get the user's permissions -> if the user's action is permitted, BFF calls the product service using client credentials as well to perform the action.

Solution 2:

FE user signs in via Cognito and performs an action -> FE sends token to BFF -> BFF forwards the token to the product service -> product service calls user service using client credentials to verify the user's permissions -> if user's action is permitted, perform it.

Evaluations:

For solution 1, the logic is very clear, BFF does the gatekeeping and all microservices trust the BFF. But I have also read that having client credentials with full authority and scope is not a good security practice for production systems.

For solution 2, the logic is a bit more convoluted because every service will be verifying the user's permissions. Token-forwarding, I have read, is also possibly bad because it means the FE user can use the token to directly call the microservices.

So I would like to hear some thoughts from people who have designed microservices.

Gary Archer · Accepted Answer · 2025-09-08 06:55:16Z

1

Aim to use the following techniques:

Use the OAuth concept of scope to set security boundaries
Keep the user identity in access tokens when a user is present and microservices act on behalf of the user.
Validate the access token in each microservice for the best security.

Client credentials should only be used when no user is present, or all resources are not user specific.

I would start with token forwarding but also use a scoped access token. Set a scope like products so that you lock down token privileges. Each microservice should validate the access token and then enforce its required scopes.

In future, you can also consider using OAuth 2.0 token exvhange from RFC 8693 when you cross microservice security boundaries, which keeps the user identity in access tokens. It doesn't seem like you need that yet though.

answered Sep 8 at 6:55

Gary Archer

30.2k2 gold badges18 silver badges38 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

BFF to microservice: client credentials or token-forwarding [closed]

1 Answer 1

Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Related