You can handle it with writing an interceptor in your Microservice B and when you send request from A to B put JWT token in your header and decode your token in B and check that token is valid or not . also you can use SSO for automate this flow . spring has own SSO named spring Authorization server that implements OAUTH 2.1 . you can use another SSOs like CAS or Keyclock and sth.

您可以通过在微服务B中编写一个拦截器来处理它，当您从A向B发送请求时，将JWT令牌放入标头中，并在B中解码令牌，然后检查令牌是否有效。您还可以使用SSO自动执行此流程。Spring有自己的SSO，名为Spring授权服务器，它实现了OAuth 2.1。你可以使用另一种SSO，如CAS或KeyClock等。

@mamJavad Bad advice. His issue comes from a leaky context, and you're suggesting to build a solution around a badly defined domain. The first thing I would ask is - why do you need to validate the token on Microservice B? Especially if communication comes from Microservice A which already validates it. Are you assuming that Microsevice A can lie to you? What are the microservices you're talking about truly responsible for - is Microservice A - Auth, and Microsevice B is what?

@mam贾瓦德坏建议。他的问题来自一个漏洞百出的环境，而您建议围绕一个定义不正确的领域构建解决方案。我要问的第一件事是--为什么需要在MicroService B上验证令牌？特别是如果通信来自微服务A，它已经对其进行了验证。你是不是认为MicroService A会对你撒谎？您所说的微服务真正负责的是什么--微服务A-Auth，微服务B是什么？

yes you are right microservice a will validate but if he want to validate at microservice B what he have to do ?

是的，你是对的，微服务A将验证，但如果他想在微服务B验证，他必须做什么？

@mamJavad That's a different scenario - the scenario he spoke off is the flow in which Microservice B is called through Microservice A. If in another scenario both Microservice A and Microservice B have public APIs - then you should create a Gateway API and validate token there. Otherwise you would have both M.A and M.B call AuthService to validate the token every time a request is made - which is inefficient to say the least. I write a bit about Gateway API here - obeycode.com/articles/7/…

@mamaJavad这是一个不同的场景-他谈到的场景是通过微服务A调用微服务B的流。如果在另一个场景中，微服务A和微服务B都有公共API-那么您应该创建一个Gateway API并在那里验证令牌。否则，每次发出请求时，M.A和M.B都会调用AuthService来验证令牌--至少可以说效率很低。我在这里写了一点关于网关API的内容-obecode.com/文章/7/…

yes it makes sense . you are right

是的，这是有道理的。你是正确的

This is what's needed, a separate AuthService. However, I would suggest avoiding making calls to it in every microservice, as it'll be too chatty, and many people consider this a leaky domain (putting dependency on auth in a domain that should be agnostic). I suggest using a Gateway API and authenticate there - the inner service doesn't need to know whether user is authenticated or not, because for all they care - it can be services consuming themselves without any input from outside world.

这就是我们所需要的，一个独立的授权服务。然而，我建议避免在每个微服务中调用它，因为它太健谈了，而且许多人认为这是一个漏泄域(将对auth的依赖放在一个应该是不可知的域中)。我建议使用Gateway API并在那里进行身份验证-内部服务不需要知道用户是否经过身份验证，因为它们都关心-它可以是使用自己的服务，而不需要来自外部的任何输入。

There are pro’s and cons with gateways. If using a gateway you are relying on an outer shell to protect tou, if you manage to bypass this shell you could possibly have access to everything. Ome example would be if i manage to for instance run rogue pods in a cluster, or start custom services in a cloud on the same vpn. Also usually to speed up gateways, they are backed by an in memory cache that holds jwts for quicker requests. This cache needs to be highly protected. Depending on what security level, and acceptable risk, one can choose one over the other.

网关有正反两面。如果你使用一个网关，你依赖一个外壳来保护你，如果你设法绕过这个外壳，你可能可以访问所有东西。例如，如果我设法在集群中运行恶意Pod，或者在同一VPN上的云中启动定制服务。通常也是为了加快网关的速度，它们由内存缓存支持，该缓存保存JWT以实现更快的请求。这个缓存需要高度保护。根据安全级别和可接受的风险，您可以选择其中一个。

Fair point, albeit I need clarification - what do you mean by "bypass" - do you mean omitting the "Gateway API" step completely and accessing services directly or having Gateway API authenticate you regardless of credentials and let the request through?

公平地说，尽管我需要澄清--您所说的“绕过”是什么意思--您是指完全省略“Gateway API”步骤而直接访问服务，还是让Gateway API在不考虑凭据的情况下对您进行身份验证并让请求通过？

i mean running something inside the same wpn and call services directly instead of going by the gateway.

我的意思是在同一个WPN内运行一些东西，并直接呼叫服务，而不是通过网关。

True, although if somebody got on your VPN - you're in equal amount of trouble, regardless to whether you had a gateway or not. I don't think this issue is inherent to Gateways - in fact, when using Gateways, it's advised to use a request source IP whitelisting, so HTTP traffic can come to service only from the Gateway - which prevents even internal calls (unless whitelisted).

没错，尽管如果有人进入了你的VPN-无论你是否有网关，你都会遇到同样多的麻烦。我不认为这个问题是网关所固有的--事实上，当使用网关时，建议使用请求源IP白名单，因此HTTP流量只能从网关提供服务--这甚至会阻止内部呼叫(除非列入白名单)。