title: Authentication between microservice approach
body: <p>I am currently building an API based around a microservices architecture.</p>
  <p>I am using JWT to authenticate users. I understand that when a user sends a login request a JWT containing the users identity and their roles/permissions etc is returned. This token is then sent with the users subsequent requests to tell the server who is sending the request. I think this is the correct understanding.</p>
  <p>In a normal monolithic architecture this works well as explained. How can I transfer this to a microservices architecture to establish trust between microservices.</p>
  <p>I could forward the users JWT to downstream microservices simply but this doesn't allow the downstream microservice to know who/which upstream microservice is sending the request.</p>
  <p>An example would be I have a location microservice. I want to allow the restaurant microservice to make calls to the location microservice. But I also have a product microservice that I do not want to be able to call the location microservice.</p>
  <p>Obviously I could just not code the product microservice to call the location microservice but this doesn't stop someone else from doing so.</p>
  <p>Any suggestions?</p>