My experience in optimizing the performance of the Microservice system by switching from symmetric to asymmetric JWTs

Current problem and challenges

In Microservice development, I found myself facing a challenging performance bottleneck in our system. I was working as a Senior Java Backend Developer on a complex Microservice architecture, and our system relied heavily on symmetric JWT (JSON Web Tokens) for authentication. While JWTs are a secure way to verify the authenticity of requests, we soon realized that our symmetric approach was causing significant congestion and dependency issues.

The core of our problem lay in the way we were managing JWTs. In our architecture, the private key used to sign JWTs was stored on the Authentication Service. This meant that any request needing authentication had to go through the Authentication Service to confirm the JWT’s validity. While this approach seemed secure, it created a significant bottleneck in our system.

As the system grew and our user base expanded, the Authentication Service became a central point of contention. The high volume of authentication requests passing through this service caused congestion, leading to slower response times across the entire system. We soon realized that if the Authentication Service experienced any issues or downtime, it had a cascading effect on the entire system, rendering it nearly unusable.

To address this problem, I started exploring alternative approaches to JWT authentication. After some research and discussions with my team, we decided to switch from symmetric JWTs to asymmetric JWTs. This change would involve using a pair of public and private keys, with the private key securely stored on the Authentication Service and the public key distributed to all microservices.

Here’s how the transformation unfolded:

• Generating Key Pairs: We generated a new pair of asymmetric keys, consisting of a private key (used for signing JWTs) and a public key (used for JWT verification). The private key remained on the Authentication Service, ensuring that only this service could sign JWTs.
• Distributed Public Key: We distributed the public key to all microservices that needed to verify JWTs. Each microservice could now independently verify the authenticity of JWTs without making additional requests to the Authentication Service.
• Reduced Dependency: With the switch to asymmetric JWTs, the congestion and high dependency on the Authentication Service significantly reduced. Microservices could now validate JWTs on their own, eliminating the need for constant communication with the Authentication Service.
• Improved Resilience: The new approach enhanced the system’s resilience. Even if the Authentication Service experienced temporary issues, other Microservices could continue to function, as long as they could verify JWTs using the public key.
• Performance Boost: We observed a noticeable performance improvement across the entire system. Response times for authenticated requests became faster, and the system’s overall throughput increased.
• Scalability: As our system continued to grow, this approach allowed us to scale individual microservices independently without causing bottlenecks at the Authentication Service.

In the end, our decision to switch from symmetric to asymmetric JWTs not only improved the performance of our microservices system but also made it more resilient and scalable. We learned a valuable lesson about the importance of balancing security with performance in microservices architecture, ensuring that our system could handle the demands of a growing user base without sacrificing speed and reliability.