OAuth 2.0 for microservices - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Architecture

intermediate

OAuth 2.0 Token Flow in Microservices

Consider a microservices system where a client app needs to access multiple services securely using OAuth 2.0. Which component is responsible for issuing access tokens that microservices validate?

A Client app issues tokens; Resource Servers validate tokens.

B Resource Servers issue tokens; Authorization Server validates tokens.

C Resource Servers issue and validate tokens internally without Authorization Server.

D Authorization Server issues tokens; Resource Servers validate tokens.

💡 Hint

Think about the OAuth 2.0 roles: who grants tokens and who protects resources.

In OAuth 2.0, the Authorization Server issues access tokens. Resource Servers (microservices) validate these tokens to allow or deny access.

❓ scaling

intermediate

Scaling Token Validation in Microservices

In a microservices architecture using OAuth 2.0, what is the best approach to efficiently validate access tokens across many services?

A Microservices cache token introspection results locally with expiration times.

B Each microservice calls the Authorization Server synchronously for every token validation.

C Microservices ignore token validation and trust the client app.

D Microservices validate tokens by decrypting JWTs without any caching.

💡 Hint

Consider reducing network calls while keeping token validation secure and fresh.

Caching token introspection results locally reduces latency and load on the Authorization Server while maintaining security by respecting token expiration.

❓ tradeoff

advanced

Choosing Between JWT and Opaque Tokens

Which is a key tradeoff when choosing JWT tokens over opaque tokens for OAuth 2.0 in microservices?

A Opaque tokens are always smaller and faster to validate than JWT tokens.

B JWT tokens require synchronous calls to Authorization Server for every request.

C JWT tokens allow stateless validation but can be large and harder to revoke immediately.

D Opaque tokens are self-contained and allow stateless validation without contacting Authorization Server.

💡 Hint

Think about token size, validation method, and revocation challenges.

JWT tokens carry claims and can be validated without contacting the Authorization Server, but revoking them immediately is difficult. Opaque tokens require introspection calls but can be revoked instantly.

🧠 Conceptual

advanced

Role of Refresh Tokens in Microservices

In OAuth 2.0 for microservices, what is the main purpose of a refresh token?

A To obtain new access tokens without requiring the user to re-authenticate.

B To directly access protected resources without an access token.

C To validate access tokens at the Resource Server level.

D To revoke access tokens when a user logs out.

💡 Hint

Think about how long access tokens last and user experience.

Refresh tokens allow clients to get new access tokens after the old ones expire without asking the user to log in again, improving usability and security.

❓ estimation

expert

Estimating Token Validation Load

A microservices system has 100 services, each receiving 1000 requests per second. Each request requires validating an OAuth 2.0 token. If each token introspection call to the Authorization Server takes 10ms, what is the minimum number of Authorization Server instances needed to handle token introspection without queuing delays, assuming each instance can handle 1000 introspections per second?

A At least 50 instances to handle 50,000 introspections per second.

B At least 100 instances to handle 100,000 introspections per second.

C At least 1 instance since caching reduces load significantly.

D At least 10 instances to handle 100,000 introspections per second.

💡 Hint

Calculate total introspection calls per second and divide by capacity per instance.

Total requests = 100 services * 1000 requests = 100,000 introspections per second. Each instance handles 1000 introspections per second, so 100,000 / 1000 = 100 instances needed.