title: Microservices Authentication best practices and security (OAuth 2.0 and OpenIdConnect)
body: <p>There are several ways to build authentication in micro-services. However very popular is using JWT tokens and OAuth protocol together with OpenID Connect identity layer.</p>
  
  <p>In <a href="http://nordicapis.com/api-security-oauth-openid-connect-depth/" rel="nofollow">this tutorial</a> explaining how it can be achieved there is one tip:  </p>
  
  <blockquote>
    <p>Pass by reference when tokens have to leave your network, and then convert them to by-value tokens as they enters your space. Do this conversion in your API gateway.</p>
  </blockquote>
  
  <p>However it's not clear to me what's reason behind it. I suspect it might be due to some security benefits (not to give client possibility to read any specific info). Because in the JWT token itself it might be info about roles/permission. But for this purpose token can also be encrypted.</p>
  
  <p>Another reason might be that JWT token is too big and in order to don't carry this token every time such approach might be used. (or if JWT token is stored in cookie it has size limits).</p>
  
  <p>I haven't seen any info that JWT token authentication is compromised and it's a bad practice to keep it on client (in browser).</p>
  
  <p>On the other hand I see that Ping Identity is also using <strong>pass by reference</strong> approach. Can you help me understand the reasoning behind it?</p>