Does HTTP belong?

[ggnbt]

@claustres This project is very strong and nice. I am very happy.

I am testing Authentication on Api Gateway. When accessing the service node from the feathers client via socket.io transport, it is checked, but when accessed from Insomnia over HTTP (fetch request from the browser), the data is returned without checking. Did I make a mistake? What should I do if it doesn't check naturally? Stop the HTTP server of service nodes?

I'm not using Docker. The examples are just run with nodejs. Lib codes was converted to CommonJS with Babel to link from typescript. Is there a reason for these?

Cote's document says "Deploying with Docker Cloud (deprecated)". What advice would you give about this? We are going to use it for long term work.

Thank you.

[claustres]

I'm not sure what you mean by "checked", do you mean authenticated ? In the API gateway scenario your service nodes should not be publicly exposed as they are not "protected" using authentication, only the gateway should be exposed. So it is normal that you can reach your service directly using HTTP or Websocket.

Docker Cloud and Docker are different beasts. Docker Cloud is simply a Cloud service but Docker is the technology that started the containers. We are using Docker compose in the example because it is simple to use on a local machine even if for Cloud deployment Docker Swarm or Kubernetes are often used. However, Docker images remains the de facto standard for container images. We are deploying services using feathers-distributed and both technologies, it works fine.

[ggnbt]

Thank you for replying.

I'm sorry. My English is a little bad. "Checked" is used as "Authenticated". In general, I almost understand. :). Can you clarify the following?

Physical servers containing service nodes are generally located on the Internet with real addresses. We cannot share the authentication configuration (i.e. secret) with those servers. Therefore, the authentication scenario on the gateway is chosen. Users often access the service through this gateway.

In this scenario, how to reuse authentication on the gateway when accessing the each service node directly via HTTP or Websocket?. Or any other issue?.

[ggnbt]

Any suggestions? sample manner:

more sample:

https://www.mathcha.io/editor/3k5BkFeMi1zCpmu4p6NMlI5n5J3liW1gYl6uDZD7El

[claustres]

In the gateway scenario the gateway should expose all services just like if they were local services. Thus you authenticate your client on the gateway then call services on the gateway as well. The fact your service node are publicly exposed on the internet, i.e. they have a public IP, does not mean the service is publicly exposed. For instance if you don't bind the port of your service on the host it will not be reachable so that there is no security concern here.

[ggnbt]

In the gateway scenario the gateway should expose all services just like if they were local services. Thus you authenticate your client on the gateway then call services on the gateway as well. The fact your service node are publicly exposed on the internet, i.e. they have a public IP, does not mean the service is publicly exposed. For instance if you don't bind the port of your service on the host it will not be reachable so that there is no security concern here.

Thank you so much. I've been exploring Docker engine and Docker swarm for a while. I think I solved my problem with your help.

Sincerely G. Ganbat