I am developing a new distributed application. I already have some operational microservice and it works fine. I am now implementing authentication/authorization and I have serious doubts.

enter image description here

1.- First I authenticate with the JWT microservice and obtain a token. This token contains the claims that indicate which properties that user has access to.

2.- This token has an expiration of 3 days. So when I make a request to a microservice I attach the token.

3.- However, when the request reaches any microservice controllers, how do I confirm that the token is valid and the user has permisions for this controller function? or if the claims have changed since the token was generated ?

Is it necessary to make another request to the JWT microservice to validate it?

Is there a more efficient way to validate each user’s permissions in microservice controllers. I would like to not have to send another request to the JWT microservice again.

I have read that an API Gateway is sometimes implemented as an access point. If so, could the user access permissions be validated in the API Gateway? What technology is the most optimal (Camel, Spring Cloud)? To this, I add that we are deploying these microservices in Google Cloud Kubernetes (GKE).

enter image description here

If someone who has experience in microservices can enlighten me.

Thank you