Guest author Peter Firmstone continues to explore and analyze the theme of #Security Baked Into the #JVM.Today's focus is on multi-Subject dispatch: how up to sixteen user Subjects cross a call on the #JERI…
Security Baked Into the JVM: sixteen Subjects on the wireAlice calls the order service. The order service calls the ledger on her behalf. At the second hop, the ledger has to decide whose authority the debit is being made under. Most stacks answer badly. Forward Alice’s bearer token verbatim, and the ledger cannot tell her from the service that relayed it. Drop the token and the ledger sees a machine, with no record that a human started the chain. Neither option lets the ledger authorize the combination.
@frankel@mastodon.top