API Gateway

🔍 What Is It?

Spring Cloud Gateway is a reactive API Gateway built on Spring WebFlux.

What an API Gateway does:

• →Routing — forward /api/orders/** to order-service
• →Authentication — validate JWT before forwarding
• →Rate limiting — limit requests per client
• →Load balancing — distribute across service instances
• →SSL termination — HTTPS at the gateway, HTTP internally
• →Request/Response transformation — add/remove headers
• →Circuit breaking — fallback if service is down
• →Logging & tracing — add correlation IDs

Key concepts:

• →Route — a rule: if predicate matches, apply filters and forward
• →Predicate — matches conditions (path, method, header, host)
• →Filter — modifies request/response (add header, rate limit, auth)

🎯 Why Do We Need It?

Without a gateway, clients must know about every microservice and call them directly. Cross-cutting concerns (auth, rate limiting, logging) must be duplicated in every service. The gateway centralizes these concerns and provides a unified API surface.

🏗️ What Happens in Real Projects?

Enterprise gateway setup:

• →Single public URL: api.company.com
• →Routes to: order-service, product-service, user-service, payment-service
• →JWT validation at gateway — downstream services trust the gateway
• →Rate limiting per API key
• →Circuit breaker to fallback page if service is down

⚙️ How It Works

Spring Cloud Gateway is built on Netty and WebFlux — fully reactive, non-blocking. Each request is matched against routes in order. The first matching route's filters are applied, then the request is forwarded. Filters can be global (apply to all routes) or per-route.

💻 Example

API Gateway Configuration — Route configuration, JWT filter, and rate limiting.

spring:
  cloud:
    gateway:
      routes:
        - id: order-service
          uri: lb://order-service  # lb:// = load balanced via Eureka
          predicates:
            - Path=/api/v1/orders/**
          filters:
            - StripPrefix=0
            - name: RequestRateLimiter
              args:
                redis-rate-limiter.replenishRate: 100
                redis-rate-limiter.burstCapacity: 200
                key-resolver: "#{@userKeyResolver}"

        - id: product-service
          uri: lb://product-service
          predicates:
            - Path=/api/v1/products/**
          filters:
            - name: CircuitBreaker
              args:
                name: product-service
                fallbackUri: forward:/fallback/products

        - id: user-service
          uri: lb://user-service
          predicates:
            - Path=/api/v1/users/**

      # Global filters applied to all routes
      default-filters:
        - AddRequestHeader=X-Gateway-Source, api-gateway
        - name: Retry
          args:
            retries: 3
            statuses: BAD_GATEWAY,SERVICE_UNAVAILABLE

🤔 Common Confusions

🚨 Common Production Issues

✅ Best Practices

🏛️ Architect's Note

💬 Frequently Asked Questions

🎯 Key Takeaways

🔗 Related Topics

🎯 Practice this topic in interviews

↗ Where this topic fits