Cloud Native Development Patterns and Best Practices

JWT assertion and filter patterns

At the business logic layer, security processing should be extremely lightweight. The federated identity management service abstracts away any difference between the various identity providers. The JWT token has already been verified and decoded by the API gateway, so no extra library is needed to handle the token. The identity token should usually include all the necessary user information and claims needed, such that no additional data needs to be retrieved from the database. The business logic simply uses the contents of the token to support its requirements.

The UUID or username of the authenticated user should be used to stamp any database update or event for auditing purposes. The claims/entitlements ...