Give the gateway a clear job
An API gateway receives requests and applies shared routing and policy before forwarding them to application services. Useful responsibilities include TLS termination, request limits, token validation, observability and carefully scoped transformations.
A gateway's token check does not establish whether the caller owns a particular order. The service that understands the resource must enforce that authorization, including tenant boundaries. Protect direct access paths too; otherwise a caller may bypass the gateway entirely.
Routing details are application behavior
A public URL and an upstream URL need not be identical. Kong documents route matching and path handling separately. In particular, strip_path changes whether the matched prefix reaches the upstream. Host preservation is another independent setting. Kong route documentation.
For an order service, write a small contract table before changing configuration:
| Public request | Intended upstream behavior |
|---|---|
| GET /api/orders/42 | Read order 42 through the order service |
| POST /api/orders | Create through the same authorization boundary |
| GET /api/orders-invalid | No accidental prefix match to a valid resource |
| Unsupported method | Explicit rejection or documented service response |
Test encoded paths, trailing slashes and overlapping routes with the selected router mode. A routing example without deployed-version validation is not a complete secure gateway setup.
Authentication plugins also need their documented credential and identity configuration. Adding a plugin name alone is not evidence that every request is authenticated.
Aggregate with a defined failure contract
A product detail screen might need catalog data, stock status and recommendations. Combining these calls server-side can reduce client coordination. It also creates a new point where slow dependencies can delay the entire response.
Microsoft's gateway aggregation guidance calls out bottlenecks, timeouts, partial results and the option to move composition into a separate service. Gateway aggregation pattern.
For this example, define catalog data as required. Recommendations may be optional. Stock can be displayed as “availability unavailable,” but must be checked again by the authoritative purchase operation. Returning a cached positive stock value as purchase approval would change business correctness.
Give the whole request a deadline, allocate dependency budgets, bound concurrency and propagate cancellation where supported. A rejected Promise.all does not automatically cancel the other operations.
Keep policy from becoming hidden business logic
Put customer-specific calculations and transactional rules in application code with explicit ownership. A small presentation composition layer can sit behind the gateway and evolve independently of route policy.
GraphQL can offer a typed composition contract, but it still needs authorization, request-cost controls and efficient resolvers. DataLoader only helps where batching and cache scope are implemented correctly.
Gateways and service meshes often serve different traffic boundaries, though individual products overlap. Choose features because of a demonstrated need rather than installing both by default.
Verify the full request path
Trace one successful request, one forbidden resource, one slow dependency and one oversized payload. Record the status, latency, upstream work and client-visible error. Verify that retries cannot duplicate a state-changing operation.
The useful gateway is one whose routing and failure behavior the team can explain, test and operate.
Sardar Mukhshaf
Full-Stack & DevOps Engineer
I build scalable web applications, secure backend systems, and production-ready cloud infrastructure. My engineering focus spans interface design, API architecture, deployment pipelines, and observability. Follow for more deep dives into system architecture, performance engineering, and emerging technologies.
More from the practice
Keep the useful ideas close.
Follow new articles with your preferred RSS reader.
Open the RSS feed ↗
