---
title: "Discussion on \"The Identity Flow: From Gateway to Database\" | Hashnode"
description: "Discussion on \"The Identity Flow: From Gateway to Database\". Tracing one request through eight checkpoints, from an Envoy header strip at the gateway to Postgres row-level security"
url: "https://hashnode.com/posts/identity-flow-gateway-to-database/6a4bc269feaaeb7f1f5820cf"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [The Identity Flow: From Gateway to Database](https://blogs.kaustavsarkar.dev/identity-flow-gateway-to-database?utm_source=hashnode&utm_medium=feed)

Tracing one request through eight checkpoints, from an Envoy header strip at the gateway to Postgres row-level security

Jul 6 · 15 min read · blogs.kaustavsarkar.dev  
Updated Jul 8  
Read the article

-   [#istio](https://hashnode.com/tag/istio)
-   [#security](https://hashnode.com/tag/security)
-   [#zerotrust](https://hashnode.com/tag/zerotrust)
-   [#zero-trust](https://hashnode.com/tag/zero-trust)
-   [#jwt](https://hashnode.com/tag/jwt)
-   [#envoy](https://hashnode.com/tag/envoy)
-   [#kubernetes](https://hashnode.com/tag/kubernetes)
-   [#servicemesh](https://hashnode.com/tag/servicemesh)
-   [#authentication](https://hashnode.com/tag/authentication)
-   [#vault](https://hashnode.com/tag/vault)

## Written by

[Kaustav Sarkar](https://hashnode.com/@kaustavsarkar)

@kaustavsarkar · Bengaluru

  
[View profile](https://hashnode.com/@kaustavsarkar)

SDE Cloudera

I write about any technical topic that catches my interest. With AI writing most of the code today, I believe understanding the why is more important than it has ever been. This blog is a sneak peek into the messy mind of an engineer who is trying to figure out the how and why.

## Responses 2

Markdown supported · ⌘↵ to post

[Mateo Ruiz](https://hashnode.com/@mateoruiz)

[Jul 7](https://hashnode.com/posts/identity-flow-gateway-to-database/6a4bc269feaaeb7f1f5820cf/comment/6a4cedce51f06fa038d60001)

This is a great example of why zero-trust is more about enforcing trust boundaries than adding authentication everywhere.

One pattern I've seen work well is keeping services completely unaware of JWTs and identity providers. Let the gateway authenticate, let the service mesh validate and project identity, and let the application focus purely on business logic. That separation makes services easier to test, swap, and secure without duplicating auth logic across every microservice.

The database identity propagation and RLS integration were especially interesting they close the loop so identity isn't lost after the request reaches the backend.

[Kaustav Sarkar](https://hashnode.com/@kaustavsarkar)

[Jul 8](https://hashnode.com/posts/identity-flow-gateway-to-database/6a4bc269feaaeb7f1f5820cf/comment/6a4cedce51f06fa038d60001#reply-6a4e294bb33a17c6421c6b2d)

This was a core requirement when I designed it. The inspiration came from migrating older services that had auth baked in, which made them tightly coupled to the existing infra. With this approach, a service can be upgraded or replaced without other components changing and without the auth flow changing. The one downside is the per-service header projection: each service needs its own EnvoyFilter to strip inbound identity headers and a RequestAuthentication to project the verified claim into a service-specific header (x-ms2-user, x-ms3-user, and so on). Its a tradeoff easier migration, security and isolation for a costlier bill :)