When you build a microservices backend, most security tutorials cover one thing well: securing the public gateway. Validate the JWT, extract the user identity, reject bad requests.
What they don't cover is what happens after the gateway.
I hit this problem while building a productivity app with four microservices — Gateway, Auth, User, and Core — each with their own database.
The Problem
Core Service needed user data from User Service. Simple enough. But the JWT was already consumed at the gateway. And my scheduled jobs had no HTTP request context at all.
