Security: Document how a callee can verify (authorize) a caller for service invocation and pub/sub

Dapr can restrict who can call a particular service through access policies on its endpoint. However there are time when a call to an endpoint is allowed and you still want to verifier the caller, either through service Invocation or pub/sub. This is to document how a callee can verifier a caller since there may be multiple callers allowed.

When your app receives calls from a Dapr sidecar via service invocation, it will include a header named "dapr-caller-app-id" which indicates the verified identity of the caller. Here's an example of headers that an app can expect when receiving a call from Dapr:


When using pub/sub, you can also verify the publisher when consuming the message via the "source" field on the Cloud Event envelope.