Stealing Your Private YouTube Videos, One Frame at a Time
Classic "confused deputy" problem. What is the current recommendation in the modern microservices world to solve it?<p>When user agent (UA) makes authenticated call to service A, which in turn makes call to service B:<p>UA -[user auth]-> A -[????]-> B<p>how to pass authentication information from A,  when making a call to B? Options I can think of:<p>- pass UA token as is. This has a problem that token becomes too powerful and can be made to call any service.<p>- pass own token and pass user auth info as an additional field. This doesn't solve confused deputy problem, since own token can be used with any user auth and service B can be tricked to make request for data in B not belonging to user<p>- Mint new unique token derived from tuple (A own token, UA token, B service name). B then extracts user information from the token presented by A and authorizes request. This seems to solve confused deputy problem, because A has no access to other UA tokens, so it can't mint a new token for a wrong user. Downside is that token minting should probably be done in another service and it requires making a call to it for almost every request between two microservices, making it a bottleneck pretty quickly.<p>I've never seen last one in real life, maybe it has some critical flaws  I am failing to see?