Spring / Spring gRPC Interview Questions
How does authentication typically work in a gRPC plus Spring setup?
Two common patterns dominate. The first is token-based: a bearer token (often a JWT) is attached via Metadata on each call, and a ServerInterceptor validates it and populates Spring Security's SecurityContext before the service method runs - conceptually similar to a REST filter validating an Authorization header.
The second is mutual TLS (mTLS), commonly used for internal service-to-service traffic, where the client's certificate itself establishes identity as part of the TLS handshake, removing the need to pass a separate token on every call. Some setups combine both - mTLS for transport-level service identity, plus a token for finer-grained user-level authorization.
What is a common way to pass a bearer/JWT token on a gRPC call?
What establishes identity directly through the TLS handshake itself in an mTLS setup?
More Related questions...
