title: Microservices security with FastAPI
body: <p>I'm working on a personal project which makes use of Python, FastAPI and a microservices architecture.</p>
  <p>I want to learn more about security so I'm trying to add some into this. I have read through the <a href="https://fastapi.tiangolo.com/tutorial/security/" rel="nofollow noreferrer">fastapi security intro</a> and it mostly makes sense to me.</p>
  <p>One thing I'm not sure about though is going about handling this cleanly in a microservices architecture.</p>
  <p>Let's assume I have 2 services, <code>user</code> service and <code>bankAccount</code> service. The <code>user</code> service is supposed to handle everything with regards to a new user registering on my site, to logging them in, etc. At this point, it shouldn't be too difficult to authenticate the user as the <code>user</code> service can access it's db.</p>
  <p>The part where I'm not sure about the best way to go forward would be with the <code>bankAccount</code> service. If a user makes a request to an endpoint within that service, how should I go about authenticating/authorising them?</p>
  <p>The two options I can think of are as follows:</p>
  <ol>
  <li>Create an <code>/authenticate</code> endpoint which has the sole purpose of other services being able to call it. Then, create a wrapper function in <code>bankAccount</code> service which wraps every endpoint and calls the <code>/authenticate</code> endpoint before running it's function</li>
  <li>Create an <code>/authenticate</code> endpoint which has the sole purpose of other services being able to call it. Then, using something like NGINX or some sort of gateway, have this called before sending the request to the <code>bankAccount</code> service.</li>
  </ol>
  <p>I lack experience/knowledge in this area so I'm not sure which of these would be the better option. I am leaning towards 2 so that I don't have to copy the wrapper code from the <code>bankAccount</code> service to any new service I create, but I don't know anything about NGINX or other gateways so any advice on how best to proceed here would be appreciated.</p>