Skip to main content

Auth Service 🔐

The Auth Service is responsible for user authentication, registration, and JWT token issuance in the ShopVerse platform.

It acts as the security entry point for users and integrates closely with the API Gateway to provide centralized authentication.

🎯 Responsibilities​

The Auth Service handles:

  • User login
  • User registration
  • Password validation & hashing
  • JWT token generation
  • Publishing authentication-related events
  • Communicating with User Service for user data

🧠 Why a Separate Auth Service?​

Separating authentication into its own service provides:

  • Clear security boundaries
  • Independent scaling
  • Easier maintenance
  • Ability to evolve auth mechanisms independently (OAuth, SSO, MFA)

Auth logic is not mixed with business services like Product or Order.

🏗️ High-Level Architecture​

🔁 Authentication Flow (Detailed)​

Login Flow​

  1. Client sends credentials to Auth Service
  2. Auth Service fetches user data from User Service
  3. Password is validated using BCrypt
  4. JWT token is generated
  5. Auth event is published to Kafka
  6. JWT is returned to client

🔐 JWT Strategy​

  • JWT is stateless
  • Issued only by Auth Service
  • Validated at API Gateway
  • Contains minimal required claims

JWT Claims​

{
  "sub": "user@example.com",
  "role": "CUSTOMER",
  "name": "User Name",
  "iat": 1710000000,
  "exp": 1710003600
}

📡 Kafka Events Published​

Event TypeTopicPurpose
USER_REGISTEREDauth-eventsNotify system of new user
USER_LOGINauth-eventsTrack login activity

These events are consumed by:

  • Notification Service
  • Analytics Service

🛡️ Security Measures​

  • Passwords stored using BCrypt hashing
  • No plaintext passwords stored or logged
  • JWT signed using HS512
  • Token expiration enforced
  • Centralized exception handling

🗄️ Data Management​

The Auth Service does not own user profile data.

Instead:

  • User details are fetched from User Service
  • Auth Service focuses only on authentication concerns

This prevents data duplication and ensures single source of truth.

⚙️ Key Components​

  • AuthController – Handles login & registration endpoints
  • AuthService – Core authentication logic
  • CustomUserDetailsService – Loads user data securely
  • JwtService – Token generation logic
  • AuthEventPublisher – Kafka event publishing
  • GlobalExceptionHandler – Consistent error responses

⚠️ Failure Scenarios​

❌ Invalid Credentials​

  • Returns 401 Unauthorized
  • No sensitive details leaked

❌ User Not Found​

  • Auth Service rejects request
  • Prevents enumeration attacks

❌ Kafka Unavailable​

  • Auth still succeeds
  • Event publishing failure is logged (non-blocking)

📈 Scalability Considerations​

  • Stateless service → horizontal scaling
  • No session storage
  • JWT allows load-balanced deployments
  • Kafka decouples downstream processing

🧪 Testing Strategy​

  • Unit tests for token generation
  • Integration tests for login flow
  • Mocked User Service responses
  • Negative test cases for invalid credentials

📌 Summary​

The Auth Service provides:

  • Centralized authentication
  • Secure credential handling
  • Stateless JWT-based security
  • Event-driven extensibility

It forms the foundation of ShopVerse’s security model and enables all other services to operate securely.