Stealing Your Private YouTube Videos, One Frame at a Time
Classic "confused deputy" problem. What is the current recommendation in the modern microservices world to solve it?When user agent (UA) makes authenticated call to service A, which in turn makes call to service B:UA -[user auth]-> A -[????]-> Bhow to pass authentication information from A,  when making a call to B? Options I can think of:- pass UA token as is. This has a problem that token becomes too powerful and can be made to call any service.- pass own token and pass user auth info as an additional field. This doesn't solve confused deputy problem, since own token can be used with any user auth and service B can be tricked to make request for data in B not belonging to user- Mint new unique token derived from tuple (A own token, UA token, B service name). B then extracts user information from the token presented by A and authorizes request. This seems to solve confused deputy problem, because A has no access to other UA tokens, so it can't mint a new token for a wrong user. Downside is that token minting should probably be done in another service and it requires making a call to it for almost every request between two microservices, making it a bottleneck pretty quickly.I've never seen last one in real life, maybe it has some critical flaws  I am failing to see?