Before Lab 2.2 — Service-to-Service Exposure

In Lab 2.2, you will prove that the internal backend service is directly reachable.

---

Service-to-service communication

In a multi-layer application, services communicate with each other:

Public Backend API → Internal Backend Service → Data Layer

This communication is internal and should not be exposed to the public internet. But an Azure App Service always gets a public hostname — https://<name>.azurewebsites.net — reachable from anywhere by default.

---

Expected caller header

The Day 2 application uses an expected caller header as a teaching mechanism. When the public backend calls the internal backend it adds:

X-Internal-Caller: backend-api

The internal backend checks for this header and logs whether the call came through the expected path or directly from outside.

This is not a security control

The expected caller header is a teaching tool, not real security.

Any caller can add this header. Real network segmentation is done at the infrastructure level.

---

What to look for in Lab 2.2

Lab 2.2 checklist

• Calling the public API trace endpoint returns a 200 and logs appear
• Calling the internal backend directly from outside also returns a 200 — this is the problem
• Both calls produce log events; the direct call shows an unexpected expectedPath value
• I can explain to a colleague why the second call should never succeed

Lab focus

In Lab 2.2, do not fix the architecture yet.

Your goal is to demonstrate the problem and observe the logs.

Lab File

Download Lab