Lion Cipher Lab
Secure a gRPC service: TLS on the wire and a token on every call
- AppSec / DevSecOps
- Intermediate
- ~75 min
- Free · no account required
Why it matters
gRPC is how a huge share of modern INTERNAL APIs talk — microservices, service meshes, control planes, mobile-to-backend — because HTTP/2 plus Protocol Buffers gives you a fast, compact, strongly-typed contract with generated clients in a dozen languages. But the shape that makes it great also makes its insecure default dangerous: the first thing every tutorial hands you is grpc.insecure_channel and server.add_insecure_port — plaintext bytes on the wire and zero authentication — and because gRPC lives BEHIND the front door, on a 'trusted' internal network, that default quietly ships to…
What you'll learn
- building a tiny gRPC service end to end: write a .proto contract, generate Python stubs with `python -m grpc_tools.protoc`, and run a server + client
- recognizing that a beginner's gRPC default — an INSECURE channel — is plaintext with no authentication, and why that is a production-outage-waiting-to-happen for an internal API
- encrypting the wire and authenticating the SERVER with TLS using grpc.ssl_server_credentials and grpc.ssl_channel_credentials over a self-signed cert
- explaining gRPC's channel-credentials vs call-credentials split, and why call credentials are only allowed to ride a secure channel (gRPC refuses to send a token over plaintext)
- adding per-call authorization with a bearer token in call metadata, enforced once in a server INTERCEPTOR rather than per-method, and returning UNAUTHENTICATED when it is missing or wrong
- naming the production 'do it better': mutual TLS (client certs) and SPIFFE/SVID workload identity for service-to-service auth, and the common mistakes that ship insecure gRPC to prod
- deciding WHEN gRPC is the right tool (internal, high-throughput, strongly-typed service meshes) versus when REST/GraphQL fits (public, browser-facing) — all on one local machine, no internet after install
Steps in this lab
- What gRPC is, and when to reach for it (vs REST/GraphQL)
- Set up: install the tools and write the contract (.proto)
- Run it the beginner way — an INSECURE channel (feel the default)
- Layer 1 — transport security: TLS with a self-signed certificate
- Layer 2 — per-call authorization: a token in metadata + a server interceptor
- Do it better in production — and the common mistakes to avoid