Why do you need an API Gateway

The microservice architecture have encouraged the splitting of large scale applications into smaller services that are good at performing single task to take advantage of the following benefits:

  • Independent service deployments
  • Faster release cycles
  • Easier maintenance
  • Granular scalability

However, this microservices don't come without its own set of problems. Splitting of services meant that APIs needed to be grouped into smaller sets (Bounded contexts) and this offloaded problems to client-side and API applications.

Client-side Issues

Leaking domain knowledge

Since client-side applications now have to deal with multiple APIs, this means that domain knowledge is now scattered across consumers thus, making them harder to maintain.

Multiple attack points

The number of APIs exposed publicly is relative to the increase of potential attack points of an application.

Requires to purchase multiple domain names and SSLs

In order to expose multiple groups of APIs publicly, owners would have to buy multiple domain names and SSL certificates.

Cross Origin Resource Sharing (CORS) issues

Client-side applications especially browsers are enforcing security measures to prevent unauthorized websites to access resources hosted on other domains. This makes it difficult to consume APIs hosted on multiple domains.

Authentication Hell

Since each API group might be managed by multiple teams, each team might end up deciding / favoring to use a specific authentication mechanisms. This results to requiring client-side applications to authenticate against each API set in different mechanisms (Cookies, HTTP Headers, oAuth)

Backend / API related Issues

Duplication and inconsistencies between cross-cutting concerns

The grouping of APIs into smaller groups introduces a potential mismatch on cross-cutting concern implementations (Authentication, Authorization, Logging, Rate Limiting, Monitoring, Security Policies, Circuit Breaking, Retries)

API Gateway to the rescue

An API gateway is a piece of software that sits in front of your microservice ecosystem. It acts as an entry point of HTTP traffic into your microservice-based applications. It does its job by containing the routing knowledge of HTTP traffic to appropriate upstream services (Much like a reverse-proxy).

The API gateway helps in making your microservice ecosystem to look like a single application from a consumer's point of view. This alone solves the problems faced by client-side applications in a way comparable to hitting multiple goals with one rock.

Its also a perfect way to offload all the cross-cutting concerns that need to be implemented in uniform fashion across a microservice ecosystem.

API Gateway Samples

Similar Articles

Get Some Cool Stuff From Amazon!

Comments

Post a Comment

Popular posts from this blog

API Gateway: Response Aggregation with Ocelot and ASP.net Core

Image
In the previous article , we've learned how to setup an API gateway using ASP.net Core and Ocelot. This article supplements the previous article by introducing downstream response aggregation through the use of API gateways. You can download the application used in this article by cloning it from GITHUB . Articles in the Series This article belongs to a series of articles that explains the importance of API gateways and how to build them using ASP.net Core. If you're interested to learn more about API gateways, it might be a good idea to spend some time reading the articles listed below. Part 1: API Gateway in a Nutshell. Part 2: Building Simple API Gateways with Ocelot. Part 3: API Response Aggregation using Ocelot P
Read more

API Gateway in a Nutshell

Image
In this article, we will explore what are API gateways, the use-cases that you wanna solve with it and the benefits that you rip out of using them. This will be an introductory post to a series of articles that will showcase API gateway development using ASP.net Core, NodeJS and Docker. Articles in the Series This article belongs to a series of articles that explains the importance of API gateways and how to build them using ASP.net Core. If you're interested to learn more about API gateways, it might be a good idea to spend some time reading the articles listed below. Part 1: API Gateway in a Nutshell. Part 2: Building Simple API Gateways with Ocelot. Part 3: API Response Aggregation using Ocelot Part 4: API Def
Read more

Building Simple API Gateways with Ocelot and ASP.net Core

Image
In the previous article , we've discovered what is an API gateway and the cool things that it brings. This article will demonstrate how to build a simple API gateway that routes incoming HTTP requests to the appropriate downstream services. Articles in the Series This article belongs to a series of articles that explains the importance of API gateways and how to build them using ASP.net Core. If you're interested to learn more about API gateways, it might be a good idea to spend some time reading the articles listed below. Part 1: API Gateway in a Nutshell. Part 2: Building Simple API Gateways with Ocelot. Part 3: API Response Aggregation using Ocelot Part 4: API Defense using Rate Limiting a
Read more

Security: HTTP headers that expose web application / server vulnerabilities

Image
Today's blog post will cover how ASP.net response HTTP headers can expose security holes in your web application and servers. The post will also contain steps on how to remove this headers and mitigate chances of getting attacked using C# and ASP.net MVC. Problem When an attacker performs an attack on a web server, the first thing he /she needs to do is to identify the profile of his target. To profile a target web application / server, an attacker would have to perform the following steps: Identify the address of the web application. Identify the OS where the web application resides Identify the type of server (IIS, Apache, etc) that was hosting the web application Identify the frameworks (ASP.net MVC, PHP, JSF) used by the applications After an attacker gathers the following information, the attacker would proceed on using penetration to
Read more