Custom authorization logic uses application-defined rules to verify a service request and decide whether to accept or reject it. It helps when OAuth2 or JWTs do not fit, or when API keys provide too little control. section 16.2 section 16.2.3
A signature-based implementation follows this pattern:
- Give the calling service a private key and the receiving service the corresponding public key. section 16.2.3
- Sign important request data, such as the path and timestamp, with the private key. section 16.2.3
- Verify the signature with the public key; reject requests whose proof is invalid. section 16.2.3
Inventory service request
An inventory service signs an /adjust-stock request and its timestamp. The product service verifies that signature before processing the request, helping detect forgery or tampering. section 16.2.3
Figure 16.7 Key pairs and asymmetric cryptographic algorithms can be used to sign requests made by services to improve security. In this approach, the service signs the request with a private key. The service receiving the request can validate the signature using the public key and decide whether to approve or reject the request.
Shows how a private key signs a service request and a public key supports the approval or rejection decision. section 16.2.3
