Overview of authentication and authorization in Microservices.Ecommerce (portfolio / local demo).

• Passwords with BCrypt (work factor 12); password is never logged.
• JWT issued with sub, email, customer_id, role.
• Configuration: Jwt:Secret, Issuer, Audience, ExpirationMinutes (environment variables in Docker).

GatewayAuthorizationMiddleware after JWT validation:

• Basket and Ordering: [Authorize] + validate URL customerId against customer_id claim (403 if mismatch).
• Ordering POST /orders: customerId comes only from the token; body does not define the customer.
• Basket → Ordering: BearerTokenForwardingHandler forwards JWT on checkout.
• Catalog: anonymous read; write requires Admin.

Use only in local environment. Do not reuse in production.

• Jwt:Secret minimum 32 characters — via appsettings, appsettings.Docker.json, or Jwt__Secret in Compose (demo).
• Do not commit .env with real secrets (see .gitignore).

• No refresh token, OAuth, or IdentityServer.
• Shared symmetric JWT (HMAC) across services.
• Inventory is public to simplify smoke tests.

Planned evolutions: ROADMAP.md.