We've now taken a look at fundamental option number one and number two for handling the question of
whether or not a user is authenticated inside of our application.
So just to summarize these two things one fundamental option number one we said that every individual
service was going to rely upon some central auth service either as some outside service or as a central
gateway.
The benefits to this approach reflected here in green is that times that we made changes to our authentication
state or the access of a user it would be immediately reflected throughout the rest of our cluster or
throughout the rest of our services.
So if we set a user was beyond as soon as the next service came and asked about the status of a user
or whether or not they were actually signed in we could absolutely say this person is banned do not
allow them access.
The really big downside to this approach was that if the service ever went down our entire app would
be broken now fundamental option were to really is the exact opposite in nature with the fundamental
option were to we were going to teach each service how to authenticate a user.
So in this case if the service ever went down Who cares.
Doesn't matter.
Our other services don't even have to understand that the authentication service exists.
That was the big upside to this approach.
However the downside was that if some user ever got banned there was gonna be a window or a period of
time where we were going to continue to trust that that user was actually signed in so we can imagine
that someone might come to us and say hey that person was just banned and we would respond.
Man I just gave them keys to my bank account or something like that five minutes ago because we are
being told too late that this user is now banned so the real question here as it really comes to us
as it applies to us which option are we going to go with.
Well the answer is we are going to go with option number two so we're going to go with option number
two specifically because I want to promote this idea of making independent services.
Remember in all things micro services there really is a spectrum throughout this course.
We've been following this idea of async communication which really leads to a huge amount of independence
between our different services but we absolutely can't have a hybrid of sorts.
We can have a setup where we've got a ton of async communication going on but we can also have some
little instances of sync communication as well.
So regardless of that I do want to promote this idea of independent services.
So we're going to go with option number two.
Now you still might say Steven wait a minute there's like a fundamental security issue here.
How would we solve that.
Well don't sweat it.
I got your back I got an answer for you.
There is a way that we can solve this entire problem of banning users or updating their authentication
state in some way.
However it is kind of a little bit longer explanation.
So we're going to take a pause right here and the next video I can give you an optional lecture.
So you do not have to listen to it if you do not want to.
But I going to tell you about one strategy we could use to get over this really big issue with option
number two.
So quick pause and we'll take a look at that in just a moment.