Microservices Security
Traditional, "PERIMETER" security, (SIRF, OUTER, boundary, PAR, security) MICROSERVICES, ke, liye, INSUFFICIENT, hai — "Zero, Trust" APPROACH, mein, HAR, SERVICE-TO-SERVICE, call, bhi, AUTHENTICATE/AUTHORIZE, ki, jaati, hai, CHAHE, WOH, INTERNAL, NETWORK, mein, hi, KYUN, na, ho.
mTLS, (Mutual, TLS) DONO, PARTIES, (client, aur, server, DONO, services) ko, EK, DUSRE, ko, CERTIFICATES, se, VERIFY, karne, deta hai — HAR, service-to-service, call, ENCRYPTED, aur, AUTHENTICATED, hoti hai.
// Zero trust — INTERNAL, call, ko, bhi, verify, karna:
app.use(async (req, res, next) => {
const token = req.headers["x-internal-token"];
const valid = await verifyServiceToken(token);
if (!valid) return res.status(401).json({ error: "Unauthorized" });
next();
});- Zero Trust = har, service-to-service, call, verify, ki, jaati, hai, internal, network, mein, bhi
- mTLS = dono, parties, certificates, se, ek, dusre, ko, verify, karte, hain
- Service mesh, se, security, application, code, se, infrastructure, mein, MOVE, ho, sakti, hai
SIMPLE, internal, communication, ke, liye, API, keys, KAAFI, ho, sakte, hain — MORE, sophisticated, systems, mein, OAuth, 2.0, "client, credentials" GRANT, TYPE, USE, kiya, jaata hai, services, ko, TOKENS, ke, saath, AUTHENTICATE, karne, ke, liye.
// OAuth client credentials flow:
const token = await getServiceToken(clientId, clientSecret);
fetch(url, { headers: { Authorization: `Bearer ${token}` } });Secrets, (API, keys, database, passwords) ko, CODE, mein, HARDCODE, karne, ki, JAGAH, DEDICATED, tools, (jaise, HashiCorp, Vault, AWS, Secrets, Manager) USE, kiye, jaate, HAIN — ROTATION, aur, ACCESS, control, ke, saath.