API Gateway: The Security and Traffic Guard

External Client
      │
      â–¼
┌──────────────────────────────────────────────┐
│                API Gateway                   │
│                                              │
│  1. TLS termination                          │
│  2. Authentication (validate JWT/API key)    │
│  3. Authorisation (check permissions)        │
│  4. Rate limiting (per user, per IP)         │
│  5. Request routing (path → service)         │
│  6. Protocol translation (REST ↔ gRPC)       │
│  7. Request/response transformation          │
│  8. Response aggregation                     │
│  9. Logging and distributed tracing          │
└──────────────────────────────────────────────┘
      │              │               │
      â–¼              â–¼               â–¼
User Service    Order Service   Payment Service

// Kong Gateway — authentication plugin configuration
// Apply globally: all routes require authentication
{
  "name": "jwt",
  "config": {
    "key_claim_name": "kid",
    "claims_to_verify": ["exp", "nbf"],
    "secret_is_base64": false
  }
}

# NGINX API Gateway — validate JWT and forward user identity
location /api/ {
    # Validate JWT using auth_jwt module
    auth_jwt "API" token=$http_authorization;
    auth_jwt_key_file /etc/nginx/jwt-public.pem;

    # Extract user ID from token claims and pass as header
    auth_jwt_claim_set $user_id sub;
    proxy_set_header X-User-ID $user_id;
    proxy_set_header Authorization "";  # Remove raw token from upstream request

    proxy_pass http://backend_services;
}

// Backend service — trusts the gateway's X-User-ID header
// No JWT verification needed; the gateway has already done it
app.get('/orders', (req, res) => {
  const userId = req.headers['x-user-id'];
  // The gateway guarantees this header is set and valid
  const orders = await ordersService.getOrdersForUser(userId);
  res.json(orders);
});

User has a "bucket" with capacity N tokens.
Each request costs 1 token.
Tokens refill at rate R per second.
If the bucket is empty, the request is rejected (429).

// Rate limiter implementation (Redis-backed, for distributed gateways)
import { createClient } from 'redis';

const redis = createClient();

async function checkRateLimit(
  userId: string,
  limit: number,       // tokens per window
  windowSeconds: number
): Promise<{ allowed: boolean; remaining: number; resetAt: number }> {
  const key = `ratelimit:${userId}`;
  const now = Date.now();
  const windowMs = windowSeconds * 1000;
  const windowStart = now - windowMs;

  // Sliding window using sorted sets: each request is a member scored by timestamp
  const pipeline = redis.multi();
  pipeline.zRemRangeByScore(key, 0, windowStart);          // Remove old requests
  pipeline.zCard(key);                                      // Count requests in window
  pipeline.zAdd(key, { score: now, value: `${now}` });     // Add current request
  pipeline.expire(key, windowSeconds);

  const results = await pipeline.exec();
  const requestCount = results[1] as number;

  if (requestCount >= limit) {
    const oldestRequest = await redis.zRange(key, 0, 0, { REV: false });
    const resetAt = parseInt(oldestRequest[0]) + windowMs;

    return { allowed: false, remaining: 0, resetAt };
  }

  return { allowed: true, remaining: limit - requestCount - 1, resetAt: now + windowMs };
}

// Express middleware using the rate limiter
app.use(async (req, res, next) => {
  const userId = req.headers['x-user-id'] as string;
  const apiKey = req.headers['x-api-key'] as string;
  const identifier = userId ?? apiKey ?? req.ip;

  // Different limits for different tiers
  const limit = apiKey ? 1000 : 100;  // API key users get 1000/min, others 100/min

  const { allowed, remaining, resetAt } = await checkRateLimit(
    identifier,
    limit,
    60  // 60-second window
  );

  res.setHeader('X-RateLimit-Limit', limit);
  res.setHeader('X-RateLimit-Remaining', remaining);
  res.setHeader('X-RateLimit-Reset', Math.ceil(resetAt / 1000));

  if (!allowed) {
    return res.status(429).json({
      error: 'Too Many Requests',
      retryAfter: Math.ceil((resetAt - Date.now()) / 1000)
    });
  }

  next();
});

# Kong Gateway — declarative routing configuration
services:
  - name: user-service
    url: http://user-service.internal:3000
    routes:
      - name: users-api
        paths: ["/api/v1/users"]
        methods: ["GET", "POST", "PUT", "DELETE"]

  - name: order-service
    url: http://order-service.internal:3001
    routes:
      - name: orders-api
        paths: ["/api/v1/orders"]
        methods: ["GET", "POST"]

  - name: payment-service
    url: http://payment-service.internal:3002
    routes:
      - name: payments-api
        paths: ["/api/v1/payments"]
        methods: ["POST"]
        plugins:
          - name: request-validator
            config:
              body_schema: '{"type": "object", "required": ["amount", "userId"]}'

External: GET /api/v1/users/123/profile
Gateway rewrites to: GET /users/123/profile (internal service path)
or
Gateway rewrites to: GET /profile?userId=123 (if service uses different convention)

# NGINX path rewriting
location /api/v1/users/ {
    rewrite ^/api/v1/users/(.*)$ /users/$1 break;
    proxy_pass http://user-service;
}

Mobile client                    API Gateway              Backend
GET /users/123 (HTTP/JSON)  →   Translates to:      →   UserService.GetUser({id: "123"})
                                gRPC call                (Protobuf binary)
                            ←   Translates response  ←   Returns User protobuf message
{"id":"123","name":"Alice"}

// user.proto
service UserService {
  rpc GetUser(GetUserRequest) returns (User) {
    option (google.api.http) = {
      get: "/api/v1/users/{id}"    // Maps HTTP GET to gRPC call
    };
  }
}

// API Gateway BFF endpoint — aggregates 3 service calls into 1 response
app.get('/api/mobile/dashboard/:userId', async (req, res) => {
  const { userId } = req.params;

  // Call three services in parallel
  const [profile, recentOrders, recommendations] = await Promise.all([
    userService.getProfile(userId),
    orderService.getRecentOrders(userId, { limit: 5 }),
    recommendationService.getRecommendations(userId, { limit: 10 })
  ]);

  // Return a single aggregated response optimised for mobile
  res.json({
    user: {
      id: profile.id,
      name: profile.name,
      avatarUrl: profile.avatarUrl
      // Mobile only needs subset of user fields — exclude large profile fields
    },
    recentOrders: recentOrders.map(o => ({
      id: o.id,
      status: o.status,
      total: o.totalAmount
      // Mobile only needs status and total — exclude full item details
    })),
    recommendations: recommendations.map(r => ({
      productId: r.productId,
      name: r.name,
      imageUrl: r.thumbnailUrl   // Mobile uses thumbnail, not full image
    }))
  });
});

# Kubernetes Deployment — multiple gateway replicas
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-gateway
spec:
  replicas: 3    # Minimum 3 for HA
  strategy:
    rollingUpdate:
      maxUnavailable: 0   # No downtime during gateway updates
      maxSurge: 1
  template:
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - topologyKey: kubernetes.io/hostname  # One replica per node
      containers:
        - name: gateway
          image: kong:3.6
          resources:
            requests:
              cpu: "500m"
              memory: "512Mi"
          livenessProbe:
            httpGet:
              path: /status
              port: 8001
            initialDelaySeconds: 10
            periodSeconds: 5