How Practical is Using Application Load Balancer for JWT Authentication?
Asked by
TechieNinja42
I recently came across some news about the Application Load Balancer (ALB) supporting client credential flow with JWT verification. I've studied for certifications and know that ALB can handle user authentication as well. Has anyone actually implemented this in real-world scenarios? I'm curious if organizations are creating unauthenticated endpoints behind an ALB, allowing it to manage authentication, or if it's more commonly used to add authentication to existing applications that previously lacked it, like custom enterprise apps.
Answers
Previously, ALB acted as an OAuth client, creating user sessions and forwarding authenticated identities to targets. Now, it can also serve as an OAuth resource, acting like a JWT authorizer. Before this, ALB couldn't validate JWTs for non-interactive accesses, but that's changed—ALB can now validate the JWT before sending the request upstream.
Reply to this answer
That’s a new feature! ALB’s JWT authentication is mainly geared towards machine-to-machine interactions, which wasn't possible before. Previously, you needed a real user to get a cookie through a browser session. Now, it broadens the use cases significantly for backend services.
Reply to this answer
Yep, that’s a pretty standard approach. By putting unauthenticated endpoints behind an ALB that handles authentication, you’re taking the security out of the application’s hands and simplifying things. Your app only checks for a valid JWT, instead of managing the entire authentication process.
Reply to this answer
Absolutely! Using ALB for this means it can tackle the heavy lifting of bad token decryption, allowing your application to just focus on authorization. The app verifies the claims but trusts that the ALB has handled the basic authentication. Kind of like how API Gateway works with Lambda functions.
Reply to this answer
While it's great that ALB supports JWT now, it feels a bit half-baked. The ALB doesn't decode the JWT claims and pass them as headers to the backend, which means apps still need to handle that. It's decent advancement but could be a lot more effective, much like how API Gateway does it.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions