Prevent bypassing authentication and authorization checks of microservices in zero trust architecture

An apparatus comprising:

• a processor;
• and
• non-transitory computer readable storage media storing code, the code being executable by the processor to perform operations comprising:
• intercepting, at a first policy engine sidecar of a first microservice, a service request from the first microservice to a second microservice, the service request comprising services requested from the second microservice;
• generating, at the first policy engine sidecar, a transaction challenge;
• transmitting the service request, a first token identifying the first microservice, and the transaction challenge to the second microservice;
• intercepting a service request response from the second microservice to the first microservice;
• determining whether the service request response comprises a second token to identify the second microservice and a transaction challenge response generated by a second policy engine sidecar of the second microservice;
• and
• transmitting the service request response to the first microservice in response to determining that the second token identifies the second microservice and in response to determining that the transaction challenge response comprises an acceptable response to the transaction challenge.

A program product comprising a non-transitory computer readable storage medium storing code, the code being configured to be executable by a processor to perform operations comprising:

• intercepting, at a first policy engine sidecar of a first microservice, a service request from the first microservice to a second microservice, the service request comprising services requested from the second microservice;
• generating, at the first policy engine sidecar, a transaction challenge;
• transmitting the service request, a first token identifying the first microservice, and the transaction challenge to the second microservice;
• intercepting a service request response from the second microservice to the first microservice;
• determining whether the service request response comprises a second token to identify the second microservice and a transaction challenge response generated by a second policy engine sidecar of the second microservice;
• and
• transmitting the service request response to the first microservice in response to determining that the second token identifies the second microservice and in response to determining that the transaction challenge response comprises an acceptable response to the transaction challenge.