spring - Communication between user-service and auth-service in microservice architecture

Question

Scenario:

This is my login scenario for my microservice application:

1. The user enters his phone number
2. A verification code will be sent
3. The user must send the received code to verify it
4. The user must enter his password
5. A JWT Token will be received

REST Implementation

For implementing the given scenario, I've created three services: auth, sms, and user. From my point of view, I think it's better to handle requests for sending verification code and generating JWT token from user-service. Here is the detail of my implementation:

• User calls POST /user/sms to send his phone number to the user-service. Inside that, a request will be made to the sms-service to send the verification code.

• Then user calls POST /user/verify to verify the code, again this request will be handled inside the user-service. If the code is valid, user-service will generate a temporary token and pass it to the header response (assume that the user is already registered into the system)

• Now the user passes his password with the temporary token via POST /user/password. If the credentials are valid, user-service will call auth-service to get a JWT token and append it to the response header of POST /user/password.

Question

Are there right communications between user<->auth and user<->sms services?

标签： springsecurityspring-securitymicroservicesrestful-authentication

Answer 1

我认为你在服务之间划定界限的方式无论如何都不是问题。我可以在这里看到一些优点和缺点

拥有单独的 SMS-Service 它使您甚至可以在其他情况下使用它，例如向用户发送其他类型的通知，如果您想更改 SMS 提供程序，这很容易，但该服务应该是独立的（使用消息代理用于通讯）。

用户服务完全没问题，但是您应该知道，对另一个服务的每个新 HTTP 调用都会产生“延迟”（您应该考虑到这一点），就像在这种情况下，当为释放 TOKEN 进行新的 http 调用时一样。

当您有一个服务调用另一个服务时，您会引入耦合。在我看来，如果你不使用任何第三方工具来处理令牌，那么我认为你应该在同一个微服务中同时拥有令牌处理和用户，我认为这样你就有了更好的限界上下文，它是更容易运行连接，因为这些数据将在同一个数据库中。

如果您使用第三方工具来处理令牌，那么将它放在不同的服务中是可以的，因为这样您将创建抽象并且将来很容易更改工具。

小心

确保每个微服务都有自己的数据库，并且您不会直接访问该服务所属的上下文之外的任何其他数据库。