Service-to-service authentication in Microservices - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the authentication method used between microservices.

Microservices

auth_method = "[1]"

Drag options to blanks, or click blank then click option'

AOAuth2

BBasicAuth

CNone

DAPIKey

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing BasicAuth which is less secure for service-to-service communication.

Using None which means no authentication.

OAuth2 is a widely used standard for service-to-service authentication in microservices.

2fill in blank

medium

Complete the code to define the token type used in service authentication.

Microservices

token_type = "[1]"

Drag options to blanks, or click blank then click option'

ADigest

BBasic

CBearer

DMAC

Attempts:

3 left

💡 Hint

Common Mistakes

Using Basic which is for username-password authentication.

Using Digest or MAC which are less common in microservices.

Bearer tokens are commonly used in OAuth2 for service-to-service authentication.

3fill in blank

hard

Fix the error in the code to correctly validate the token expiration time.

Microservices

if current_time > token.[1]:

Drag options to blanks, or click blank then click option'

Aissued_at

Bexpires_at

Cvalid_until

Dcreated_at

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'issued_at' which is when the token was created, not expiration.

Using 'valid_until' which is not a standard field.

Token expiration is checked against the 'expires_at' timestamp.

4fill in blank

hard

Fill both blanks to complete the token validation logic.

Microservices

if token.[1] and token.[2] == True:

Drag options to blanks, or click blank then click option'

Ais_active

Bis_valid

Cis_expired

Dis_revoked

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'is_expired' which should be False for valid tokens.

Using 'is_revoked' which should be False for valid tokens.

Tokens must be active and valid to be accepted.

5fill in blank

hard

Fill all three blanks to complete the service-to-service authentication flow.

Microservices

token = auth_server.get_token(client_id=[1], client_secret=[2])
headers = {"Authorization": "[3] " + token}
response = service.call_api(headers=headers)

Drag options to blanks, or click blank then click option'

A"my_client_id"

B"my_client_secret"

CBearer

DBasic

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Basic' instead of 'Bearer' in the header.

Mixing client ID and secret values.

The client ID and secret are used to get the token, which is sent with 'Bearer' in the Authorization header.

Practice

1. What is the main purpose of service-to-service authentication in microservices?

easy

A. To ensure that one service can securely verify the identity of another service

B. To speed up communication between services

C. To store data between services

D. To monitor the health of services

Solution

1. Step 1: Understand the role of authentication

   Authentication is about verifying identity to ensure trust between entities.

2. Step 2: Apply to microservices context

   In microservices, service-to-service authentication ensures one service knows it is talking to a trusted service.

3. Final Answer:

   To ensure that one service can securely verify the identity of another service -> Option A

4. Quick Check:

   Authentication means verifying identity = A [OK]

Hint: Authentication means verifying identity between services [OK]

Common Mistakes:

• Confusing authentication with data storage
• Thinking authentication speeds up communication
• Mixing authentication with monitoring

2. Which of the following is a common method used for service-to-service authentication?

easy

A. Using JWT tokens issued by an authentication server

B. Using SQL queries to verify service identity

C. Using CSS styles to secure communication

D. Using HTML forms for authentication

Solution

1. Step 1: Identify valid authentication methods

   JWT tokens are widely used for secure token-based authentication between services.

2. Step 2: Eliminate unrelated options

   SQL queries, CSS, and HTML forms are unrelated to service authentication.

3. Final Answer:

   Using JWT tokens issued by an authentication server -> Option A

4. Quick Check:

   JWT tokens = common authentication method [OK]

Hint: JWT tokens are standard for service authentication [OK]

Common Mistakes:

• Confusing UI technologies with authentication
• Thinking database queries authenticate services
• Mixing frontend and backend concepts

3. Consider this simplified code snippet for service-to-service authentication using JWT:

token = auth_server.issue_token(service_id="serviceA")
if auth_server.verify_token(token):
    print("Access granted")
else:
    print("Access denied")

What will be printed if the token is valid?

medium

A. Access denied

B. Error: token missing

C. Access granted

D. No output

Solution

1. Step 1: Understand token issuance and verification

   The token is issued by the auth server and then verified immediately.

2. Step 2: Check the conditional logic

   If the token is valid, verify_token returns True, so "Access granted" is printed.

3. Final Answer:

   Access granted -> Option C

4. Quick Check:

   Valid token means access granted [OK]

Hint: Valid token means verify_token returns True [OK]

Common Mistakes:

• Assuming token is invalid without checking
• Confusing print outputs
• Ignoring the if-else structure

4. A microservice uses mTLS for service-to-service authentication but fails to connect. Which is the most likely cause?

medium

A. The server service is down

B. The API key is expired

C. The database is unreachable

D. The client service does not have a valid client certificate

Solution

1. Step 1: Understand mTLS requirements

   mTLS requires both client and server to have valid certificates for mutual authentication.

2. Step 2: Identify the cause of failure

   If connection fails due to authentication, missing or invalid client certificate is the likely cause.

3. Final Answer:

   The client service does not have a valid client certificate -> Option D

4. Quick Check:

   mTLS needs valid client cert = B [OK]

Hint: mTLS needs valid client certificate on both sides [OK]

Common Mistakes:

• Blaming server downtime without checking certificates
• Confusing database issues with authentication
• Mixing API keys with mTLS

5. You design a system where multiple microservices authenticate each other using JWT tokens issued by a central auth server. To improve scalability and security, which approach is best?

hard

A. Each service calls the auth server to verify tokens on every request

B. Each service validates tokens locally using the auth server's public key without calling the auth server every time

C. Services share a single API key for all authentication

D. Services trust any token without verification to reduce latency

Solution

1. Step 1: Consider scalability of token verification

   Calling the auth server on every request creates a bottleneck and reduces scalability.

2. Step 2: Use public key verification locally

   JWT tokens can be verified locally using the auth server's public key, improving speed and security.

3. Final Answer:

   Each service validates tokens locally using the auth server's public key without calling the auth server every time -> Option B

4. Quick Check:

   Local JWT verification improves scalability = A [OK]

Hint: Verify JWT locally with public key for scalability [OK]

Common Mistakes:

• Calling auth server on every request causing bottlenecks
• Using shared API keys reduces security
• Skipping token verification breaks security