Applying Spring Security Framework and OAuth2 To Protect Microservice Architecture API

Abstract

Since 2014, Microservice Architecture (MSA) has been widely applied and deployed by big companies such as Google, Netflix and Twitter. This is a way of architecting software systems in which the services of a single application are decomposed then deployed and executed separately. This research examines the possibility of applying Spring Security Framework and OAuth2 to secure microservice APIs which are built on top of Spring Framework. By developing a Proof of Concept (POC) of an Inventory Management System using MSA on top of Spring Framework, Spring Security Framework and OAuth2. we have conducted security tests over the POC using unit testing and manual testing techniques to examine if there are any vulnerabilities and we were able to show and confirm the effectiveness of the Spring Security Framework and OAuth2 in securing Spring-based APIs.

Applying Spring Security Framework with KeyCloak-Based OAuth2 to Protect Microservice Architecture APIs: A Case Study

“…However, these studies were performed separately without verifying the efficacy of the Spring Framework (SF), SSF, and OAuth2 when these technologies were used on MSA endpoint authentication and authorization. Nguyen et al [15] created a proof-of-concept (PoC) MSA application using SF, spring protection, and OAuth2 to reduce the information gap on MSA and API security. They did not test how the solution would work after integrating with a third-party IAM platform.…”

“…Therefore, maintaining the privacy and security of EHRs has become an open challenge. In combination with open source KeyCloak software [27], the Spring Security [14][15][16] paradigm may offer an opportunity to enhance security features, functionalities, identity brokering, session handling, CORS support, access management solutions, and security assertion markup language (SAML) [28] for a health system's web and REST APIs. The required security background for understanding the SSK security solution is discussed in this section.…”

“…Spring Security Framework [14][15][16] is a robust, highly customizable, comprehensive, and extensible open-source Java framework supporting authentication and authorization. Furthermore, it provides a solution to protect common external attacks [28][29][30][31][32][33][34][35][36][37], such as session fixation, clickjacking, CSRF, etc.…”

“…Microservice Architecture (MSA) [29][30][31][32][33][34][35][36][37] has arisen to describe a specific way of developing software systems for independently deployable services. The traditional monolithic software development approach suffers from the following drawbacks: bundled deployment as a single stack, intransigent scalability, high cost of resources and refactoring efforts, and DevOps challenges among dispersed teams [15,16]. In contrast, MSA handles such concerns with the following measures: task decomposition into services, service communication using APIs with the smallest granularity, agility, independent deployment, and execution of services.…”

Computer Science and Information Technology Trends

“…[23] Applying Spring Security Framework and OAuth2 To Protect Microservice Architecture API. [24] Design of a micro-service based Data Pool for device integration to speed up digitalization. [25] Hybrid Blockchain-Enabled Secure Microservices Fabric for Decentralized Multi-Domain Avionics Systems.…”