Extra security layer: Only allow requests from server or IP.

@pixelairport If you know that there’s only going to be one other micro service accessing this service then yeah, you could create some middleware that only accepts requests from a specific IP address:

class CheckRequestIsComingFromUpstreamService
{
    public function handle(Request $request, Closure $next)
    {
        if ($request->ip() === 'XXX.XXX.XXX.XXX') {
            return $next($request);
        }

        abort(403);
    }
}

That will reject requests coming from any other IP address. So if someone did get your access tokens, they wouldn’t be able to authenticate and invoke your service from any other machine.

The downside is, this means the upstream service has to have a static IP address, and if the IP address does change, then you need to change either your codebase or a configuration value somewhere.

I just got an idea or maybe how to do it better. Hope someone will read it, because i marked this post already as solved.

I connected the Gateway/Auth-Server the whole time with a "Client Credentials Grant Token" to the microservice. The user authenticates before(with his Access Token) to the gateway and each request must be done to the request.

Now the idea... what if i dont do it with the "Client Credentials Grant Token" (machine-to-machine) and build a middleware in the microservice. Then i forward not only the request from the gateway, also the bearer of the user access token in authorization. And in the middleware of the microservice i do a second request back to gateway, where the microservice try to check at the gateway, if the user is logged in and get the infos for the user: UserId, Which plan user have, and so on... Is that to much traffic? Or would this be a good solution. That would avoid, that users can use any user id. They must be logged into my app and have their own key. If someone will hack everything, he needs all the current user keys instead only of one to have all access to the microservice.

I know I should keep it simple, but i also want a good solution instead of refactor all things later. And this sounds really good for my. I try to find the best way... simple but also clean and secure.

I did a test and it seems to be the best solution. I made a scribble to aks here, if there is something which is against this solution?

For me this solution works, I understand it, think that is clear, ... but maybe I forgot something, which is not good with this solution.

Ok. I talked to a friend, who knows a lot more about this topic. He says that it is a better solution.