JWT Token Forwarding — Propagating Identity Across Microservice Boundaries

In this tutorial, you will learn about JWT Token Forwarding. We cover key concepts, practical examples, and best practices to help you master this topic.

JWT token forwarding propagates authentication context through microservice call chains, allowing downstream services to identify the original caller while preventing privilege escalation.

What You'll Learn

• Forwarding original JWTs through service chains
• Token exchange for service-specific scopes
• Forward-proxy and reverse-proxy patterns
• Preventing token leakage in logs and headers
• Service identity vs user identity

Why It Matters

In microservice architectures, the original caller's identity must propagate through multiple services. Without proper forwarding, downstream services either lose context or receive overly broad tokens. DodaTech's platform propagates caller identity across 15+ Microservices without exposing tokens to unauthorized services.

sequenceDiagram
    participant Client
    participant GW as API Gateway
    participant S1 as Auth Service
    participant S2 as Threat Service
    participant S3 as Report Service

    Client->>GW: Request with broad JWT
    GW->>GW: Validate JWT, extract user
    GW->>S1: Forward original JWT
    S1->>S1: Exchange for service-specific JWT
    S1->>S2: Call with narrow-scoped JWT
    S2->>S2: Process with user context
    S2->>S3: Propagate user context header
    S3-->>S2: Response
    S2-->>S1: Response
    S1-->>GW: Response
    GW-->>Client: Final response

What's Next

Combine forwarding with {{< ilink "JWT" "JWT Token Binding" }} for secure service-to-service calls, and explore {{< ilink "JWT" "JWT Revocation" }} for handling compromised tokens in Distributed Systems.