api-gateway-reverse-proxy-expert

license	Apache-2.0
name	api-gateway-reverse-proxy-expert
description	API gateway and reverse proxy configuration with Kong, Nginx, Traefik, routing, and auth middleware. Activate on: API gateway, reverse proxy, Kong, Nginx, Traefik, load balancer, ingress, auth middleware. NOT for: rate limiting algorithms (use api-rate-limiting-throttling-expert), service mesh (use service-mesh-microservices-expert).
allowed-tools	Read,Write,Edit,Bash(npm:*,npx:*,docker:*,kubectl:*)
category	Backend & Infrastructure
tags	["api-gateway","reverse-proxy","nginx","kong","traefik"]
pairs-with	[{"skill":"api-rate-limiting-throttling-expert","reason":"Rate limiting is a core gateway plugin"},{"skill":"service-mesh-microservices-expert","reason":"Gateways sit at the edge of service meshes"},{"skill":"observability-apm-expert","reason":"Gateway-level tracing and metrics collection"}]

API Gateway & Reverse Proxy Expert

Configure and optimize API gateways and reverse proxies for routing, authentication, rate limiting, and traffic management.

Decision Points

Authentication Strategy Selection

Traffic Pattern & Requirements
├── Internal services only
│   └── API Key authentication
│       ├── Low complexity, fast validation
│       └── Kong: key-auth plugin, Traefik: forwardAuth
├── Customer-facing API with session needs
│   └── JWT authentication
│       ├── Stateless, includes user claims
│       └── Kong: jwt plugin, Nginx: lua-resty-jwt
├── Enterprise B2B integration
│   └── mTLS authentication
│       ├── Certificate-based, highest security
│       └── Kong: mtls-auth, Nginx: ssl_verify_client
└── Third-party SaaS integration
    └── OAuth2 flow
        ├── Token exchange, delegated auth
        └── Kong: oauth2 plugin, AWS API Gateway: authorizer

Gateway Technology Selection

Requirements → Choice
├── Plugin ecosystem & GUI needed
│   └── Kong Enterprise/OSS
├── Kubernetes-native with auto-discovery
│   └── Traefik v3 or Ingress-NGINX
├── Maximum performance, minimal features
│   └── Nginx or Envoy
└── Cloud-managed, serverless scaling
    └── AWS API Gateway or Azure Application Gateway

Upstream Routing Strategy

Service Architecture → Routing Method
├── Microservices with service discovery
│   └── Dynamic upstream targets
│       ├── Consul/Eureka integration
│       └── Health check based load balancing
├── Static backend services
│   └── Fixed upstream pools
│       ├── Round-robin or least-connections
│       └── Weighted routing for canary deployments
└── Multi-region deployment
    └── Geographic routing
        ├── Latency-based or geo-IP
        └── Fallback to secondary regions

Failure Modes

Gateway Timeout Cascade

Symptom: Slow API responses (>10s) under load
Detection: Response times spike while upstream services report normal latency
Root Cause: Gateway timeout higher than upstream timeout, causing request queuing
Fix: Set gateway read timeout < upstream timeout (gateway: 30s, upstream: 25s)

Authentication Bypass

Symptom: Unauthorized requests reaching backend services
Detection: Backend logs show requests without expected auth headers
Root Cause: Route order allows permissive rules to match before auth rules
Fix: Move auth middleware to global level or ensure specific routes come first in config

Circuit Breaker Thrashing

Symptom: Intermittent 503 errors during traffic spikes Circuit breaker opens/closes rapidly (multiple times per minute) Threshold too sensitive or health check misconfigured Tune failure threshold (5+ failures) and recovery time (30s minimum)