Microservices authentication architecture with passport.js
<p>I'm writting a toy application for practicing microservices and authentication on nodejs (expressjs).</p>

<p>I have a react client, an authentication service and other services (they just respond "Hi" so far).</p>

<ul>
<li>The client will be hosted in a CDN.</li>
<li>The auth service listens on port 5000 (for example)</li>
<li>The rest of the services listen on port 6000-6100.</li>
<li>I have a redis db to store session information (oauth token provided by twitter).</li>
<li>A mongodb where the application information is stored (not relevant for this question).</li>
</ul>

<p>The idea is that an unauthenticated client goes to the auth service by clicking the Twitter button (SSO). Then the auth service obtains the generated twitter oath token and it sets this token in the redis store. Then the token is accessible to the rest of the services so they know if a request is authenticated or not by checking if the it already exists in the redis store (if the user removes its account, it will also be deleted from the redis store).
I send the twitter token back and forth from client to server once authenticated.</p>

<p><a href="https://i.stack.imgur.com/WGNoK.png" rel="noreferrer"><img src="https://i.stack.imgur.com/WGNoK.png" alt="enter image description here"></a></p>

<p>I find this approach pretty simple (others use an nginx proxy for authentication but I see no reason for that, except if the services are hosted in different domains, but I don't understand it very well) so I'm worried I'm missing something about security for example.</p>

<p>Questions:</p>

<ol>
<li>Is this approach correct? </li>
<li>Is it safe to share the twitter token (I think so)?</li>
<li>Is there any security issue I'm not noticing here?</li>
</ol>