Token-Based Authentication for gRPC Requests

[gaius-qi]

Description

Enhance the security of inter-component interactions based on Token-Based Authentication for gRPC Requests. Additionally, use JWT Tokens for authentication.

It is necessary to refer to community best practices to implement the feature.

Link

Dragonfly Repo: https://github.com/dragonflyoss/dragonfly
Client Repo: https://github.com/dragonflyoss/client

[sabarixr]

@gaius-qi Hello! If this issue is still available, I would like to take it.

I want to confirm two things to make sure the implementation isuue:

1. Should all inter component gRPC calls require JWT auth, or should there be a configuration flag that permits disabling it for backward compatibility?

2. Should the first implementation use a static secret key from configuration (HS256) for signing and verification, or would you rather set up RSA keypair support (RS256) immediately?

[gaius-qi]

@sabarixr All component require JWT auth. You can refer to the community's best practices.