Context propagation in service-oriented architecture via authorization libraries

1 . A computer-implemented method, comprising:

receiving, by a first service and from a client device, an incoming request, wherein an authorization library for the first service is configured to intercept the incoming request and store a context token from a first header of the incoming request in context storage;

determining, by the first service, that fulfilling the incoming request involves calling a second service that uses the context token;

responsive to determining that fulfilling the incoming request involves calling the second service, requesting, by the first service and from the authorization library, the context token for the incoming request from the context storage configured to store the context token, the authorization library being configured to attach the context token to an outgoing request responsive to the requesting; and

transmitting, by the first service, the outgoing request to the second service, a second header of the outgoing request comprising the context token, the second service being configured to generate an output for the outgoing request based at least in part on the context token.

2 . The computer-implemented method of claim 1 , further comprising:

generating, by the first service, a response to the incoming request based at least in part by the output from the second service and the context token; and

transmitting, by the first service, the response to the client device.

3 . The computer-implemented method of claim 1 , wherein the context token includes context information comprising at least one of an identification of the client device, a location of the client device, an identification of a user associated with the client device, a type of user, and a type of incoming request.

4 . The computer-implemented method of claim 1 , wherein the authorization library is configured to, responsive to the first service receiving the incoming request:

detecting context information for the incoming request in the context token; and

responsive to detecting the context information in the context token, storing the context token in the context storage.

5 . The computer-implemented method of claim 1 , further comprising,

responsive to receiving the incoming request:

detecting an absence of context information for the incoming request in the first header; and

responsive to detecting the absence of context information in the first header, storing a placeholder token in the context storage as the context token for the incoming request.

6 . The computer-implemented method of claim 5 , further comprising responsive to requesting the context token for the incoming request, attaching the placeholder token to the second header of the outgoing request.

7 . The computer-implemented method of claim 1 , wherein the context token is part of a plurality of context tokens stored in the context storage for a plurality of incoming requests, and wherein the method further comprises, responsive to requesting the context token for the incoming request from the context storage:

identifying the context token of the plurality of context tokens stored in the context storage by:

determining the incoming request associated with the outgoing request to the second service; and

identifying the context token associated with the incoming request in the plurality of context tokens stored in the context storage.

8 . The computer-implemented method of claim 1 , further comprising generating telemetry data for the context token responsive to (i) storing the context token in the context storage, (ii) requesting the context token from the context storage, and (iii) attaching the context token to the outgoing request.

9 . The computer-implemented method of claim 1 , wherein the incoming request does not include the context token, and wherein the computer-implemented method further comprises:

detecting context information in the incoming request;

generating the context token for the incoming request based on the context information; and

responsive to generating the context token, storing the context token in the context storage.

10 . A system, comprising:

one or more memories configured to store computer-executable instructions; and

one or more processors configured to access the one or more memories and execute the computer-executable instructions to at least:

receive, by a first service and from a client device, an incoming request, wherein an authorization library for the first service is configured to intercept the incoming request and store a context token from a first header of the incoming request in context storage;

determine, by the first service, that fulfilling the incoming request involves calling a second service that uses the context token;

responsive to determining that fulfilling the incoming request involves calling the second service, request, by the first service and from the authorization library, the context token for the incoming request from the context storage configured to store the context token, the authorization library being configured to attach the context token to an outgoing request responsive to the requesting; and

transmit, by the first service, the outgoing request to the second service, a second header of the outgoing request comprising the context token, the second service being configured to generate an output for the outgoing request based at least in part on the context token.

11 . The system of claim 10 , wherein the one or more memories are configured to store additional computer-executable instructions that when executed by the one or more processors cause the one or more processors to:

generate, by the first service, a response to the incoming request based at least in part by the output from the second service and the context token; and

transmit, by the first service, the response to the client device.

12 . The system of claim 10 , wherein the context token includes context information comprising at least one of an identification of the client device, a location of the client device, an identification of a user associated with the client device, a type of user, and a type of incoming request.

13 . The system of claim 10 , wherein the authorization library is configured to, responsive to the first service receiving the incoming request:

detecting context information for the incoming request in the context token; and

responsive to detecting the context information in the context token, storing the context token in the context storage.

14 . The system of claim 10 , wherein the one or more memories are configured to store additional computer-executable instructions that when executed by the one or more processors cause the one or more processors to, responsive to receiving the incoming request:

detect an absence of context information for the incoming request in the first header; and

responsive to detecting the absence of context information in the first header, store a placeholder token in the context storage as the context token for the incoming request.

15 . One or more non-transitory computer-readable storage media comprising computer-executable instructions that, when executed by one or more processors of a computer system, cause the computer system to perform operations comprising:

storing, by an authorization library for a first service, a context token from a first header of an incoming request received from a client device in context storage, the incoming request received by the first service, the context token comprising context information for the incoming request, the authorization library being configured to intercept the incoming request;

determining, by the first service, that fulfilling the incoming request involves calling a second service that uses the context token;

responsive to determining that fulfilling the incoming request involves calling the second service, requesting, by the first service and from the authorization library, the context token for the incoming request from the context storage, the authorization library being configured to attach the context token to an outgoing request responsive to the requesting; and

transmitting, by the first service, the outgoing request to the second service, a second header of the outgoing request comprising the context token, the second service being configured to generate an output for the outgoing request based at least in part on the context information in the context token.

16 . The one or more non-transitory computer-readable storage media of claim 15 , further comprising computer-readable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

determining, by the second service, that fulfilling the outgoing request involves calling a third service, wherein the outgoing request is a first outgoing request and the output is a first output; and

responsive to determining that fulfilling the outgoing request involves calling the third service, requesting, by the second service and from the authorization library, the context token for the incoming request from the context storage, the authorization library being configured to return the context token for a second outgoing request responsive to the requesting.

17 . The one or more non-transitory computer-readable storage media of claim 16 , further comprising computer-readable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

responsive to determining that fulfilling the outgoing request involves calling the third service, generating, by the second service, the second outgoing request to the third service;

receiving, by the second service, the context token from the authorization library;

determining that the second outgoing request does not comprise the context token;

responsive to determining that the second outgoing request does not comprise the context token, attaching the context token to a third header of the second outgoing request; and

transmitting the second outgoing request comprising the context token to the third service, the third service configured to generate a second output to the second outgoing request based at least in part on the context token.

18 . The one or more non-transitory computer-readable storage media of claim 17 , further comprising computer-readable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

generating, by the third service, the second output comprising a denial of the second outgoing request based at least in part on the context token; and

generating, by the first service, a response to the incoming request comprising a denial of the incoming request based at least in part on the denial of the second outgoing request.

19 . The one or more non-transitory computer-readable storage media of claim 17 , further comprising computer-readable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

receiving, by the second service, the second output from the third service;

generating, by the second service, the first output for the first service based at least in part on the context token and the second output from the third service; and

transmitting, by the second service, the first output to the first service.

20 . The one or more non-transitory computer-readable storage media of claim 19 , further comprising computer-readable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

receiving, by the first service, the first output from the second service;

generating, by the first service, a response to the incoming request based at least in part on the context token and the first output from the second service; and

transmitting, by the first service, the response to the client device.