Design the authentication strategy for a banking application (EazyBank) with a separate Angular frontend and Spring Boot backend microservices.
Use OAuth2/OIDC with a central Authorization Server (Keycloak or Spring Authorization Server): the Angular app performs Authorization Code + PKCE against the Auth Server (never touching backend credentials directly), receiving a JWT access token. Each backend microservice (Accounts, Loans, Cards) acts as a stateless resource server, validating the JWT locally via JWKS, with fine-grained authorization enforced through role/authority claims mapped from the token, plus method-level @PreAuthorize checks for ownership rules like 'this account belongs to this user'.
Ready to master this question?
Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.
Sign in to generate a response