Security in Microservices

Secure microservices with defence in depth: authenticate with OAuth2 and JWT, authorize with RBAC, terminate TLS at the gateway, encrypt service-to-service with mTLS, keep secrets in a vault, and trust nothing merely for being inside the network.

Stop brute force with layers: rate-limit attempts, lock accounts after repeated failures, challenge with CAPTCHA, require MFA so a password alone is useless, blacklist abusive IPs, monitor and alert on patterns, and keep tokens short-lived.

The login endpoint verifies credentials and JwtUtil signs a token, a once-per-request filter validates it and sets the security context, and the security config wires stateless sessions with the filter, giving stateless OAuth2-style authentication.

A JWT is a signed, self-contained token of three Base64Url parts: header, payload with claims, and signature; the signature guarantees integrity but the payload is readable by anyone, so never put sensitive data in it.