How do you handle validation in a composite microservices request?

Consider an application with two objects:

• User
  
  (contains basic user data such as name)
• Passport
  
  (contains credentials i.e. password)

And two internal microservices:

• UserService
  
  (responsible for creating and managing users and their master data)
• AuthService
  
  (responsible for user authentication and password handling)

The object User

belongs to the object UserService

and Passport

belongs AuthService

.

These two services should be kept separate as they perform very different tasks: profile data and authentication.

Also, consider that we have a registration form with three fields:

• Email
• Name
• Password

This form will initiate an HTTP request in GatewayService

, which intercepts all requests to the application and routes them to internal microservices (or assembles / aggregates them).

Now that the gateway service receives a request with all the form data, it needs to do the following:

• A call UserService
  
  to create a new user (it will respond with a generated one userId
  
  ).
• Call AuthService
  
  to create a passport for the newly created user. It will need the userId
  
  one obtained in step # 1 and the field password
  
  from the original request.

It looks pretty straightforward, but what happens if it's AuthService

not available in step 2? We need to separate these requests somehow!

The classic approach is to use finite consistency and create an object Passport

through an asynchronous call (we can queue this request and process it in a separate service). To do this, we will send an asynchronous request to AuthService

passing through userId

and password

instead of step # 2, so step # 1 will immediately return a response to the client.

However, what if the field is password

not formatted correctly (violating validation rules)? The validation logic is only present in AuthService

, so we cannot know if the password is correct until the call is made. And now the request is processed asynchronously, so we cannot go back to the user and ask him to correct the password.

SO, how do you properly handle validation in distributed compound queries for a microservice application?

• The naive solution is to move the validation logic to itself GatewayService
  
  , but that is a terrible idea because that will make it thick and leak the business logic out of AuthService
  
  .

• Another idea is to provide an additional password verification method and call it before steps # 1 and # 2. This seems like a viable solution, but it will force us to have two methods for each business method in our microservices, one for preliminary validation and one for actual work. In addition, there is a time gap between validation and the operation, so the earlier correct value may become incorrect when the operation is performed.

• We could split the form into two parts to avoid complicated requests and prompt the user for a password after requesting personal information and creating an account for him. However, this can lead to security issues where the user account could be intercepted by another party who might guess the next one userId
  
  . We could use some additional security token, but it will introduce odd functionality to the services and make the complex setup more difficult.

  Also, this approach is like trying to avoid the problem, you can't always avoid compound queries.

• We could use full blown distributed transactions, for example. 2PC , but it would make the system extremely complex and mitigate the use of MSA in the first place.

• And the last idea is to bundle these two services together, but for a microservice architecture that doesn't make sense.