JWT Authentication Microservice

GoJWTgRPC

Problem

Each backend service needed its own way to issue and validate user sessions, risking inconsistent auth logic and duplicated login flows across services.

Solution

Built a standalone Go auth microservice that issues JWTs, manages sessions via HTTP-only cookies, and exposes login/error views plus a gRPC-reachable token-validation endpoint that other services call directly instead of re-implementing auth.

Challenges

Keeping token validation fast enough to call synchronously from other services over gRPC, while still supporting cookie-based sessions for browser clients.

Results

A single source of truth for authentication across the system, with dependent services validating tokens via a gRPC call instead of maintaining their own auth logic.