Implements security controls at the API gateway layer including authentication enforcement, rate limiting, request validation, IP allowlisting, TLS termination, and threat protection. The engineer configures API gateways (Kong, AWS API Gateway, Azure APIM, Apigee) to act as a centralized security enforcement point that validates, throttles, and monitors all API traffic before it reaches backend services. Activates for requests involving API gateway security, API management security, gateway authentication, or centralized API protection.
Implements security controls at the API gateway layer including authentication enforcement, rate limiting, request validation, IP allowlisting, TLS termination, and threat protection. The engineer configures API gateways (Kong, AWS API Gateway, Azure APIM, Apigee) to act as a centralized security enforcement point that validates, throttles, and monitors all API traffic before it reaches backend services. Activates for requests involving API gateway security, API management security, gateway authentication, or centralized API protection.
Deploying a centralized authentication and authorization layer for microservice APIs
Implementing rate limiting, throttling, and quota management across all API endpoints
Configuring request/response validation against OpenAPI specifications at the gateway level
Setting up TLS termination, mutual TLS, and certificate management for API traffic
Integrating WAF rules with the API gateway to block injection, XSS, and known attack patterns
Do not use as the sole security layer. API gateways provide defense in depth but backend services must also validate authorization and input.
Common Misconfigurations & Verification
Gateway-only authorization: treating the gateway as the sole control lets anyone who reaches the backend directly bypass it - backends must re-verify and be protected with mTLS/network policy.
Per-IP rate limiting: use limit_by: credential, not IP, or attackers rotate IPs to bypass.
Lax OAS validation: without additionalProperties: false and strict body/param validation, mass assignment and injection pass straight through.
Verbose errors: gateway error responses leaking upstream/stack/version info aid recon - set verbose_response false and strip Server/X-Powered-By.
JWT alg/issuer not pinned: failing to pin algorithms, issuer, audience, and max TTL enables token confusion.
CORS wildcard with credentials:Access-Control-Allow-Origin: * plus credentials is a cross-origin data leak.
How to verify it works: send expired/invalid/none-alg tokens and confirm rejection; exceed the limit and confirm 429; submit schema-violating and extra-field payloads and confirm 400; hit a backend directly (bypassing the gateway) to confirm it independently enforces auth; curl -I to confirm security headers are present and Server/X-Powered-By are removed.
Prerequisites
API gateway platform selected and deployed (Kong, AWS API Gateway, Azure APIM, or Apigee)
OpenAPI/Swagger specifications for all backend APIs
TLS certificates for the gateway domain
Identity provider (IdP) configured for OAuth2/OIDC (Okta, Auth0, Azure AD)
Monitoring and logging infrastructure (CloudWatch, Datadog, ELK)
Backend service endpoints registered and reachable from the gateway
Workflow
Step 1: Kong Gateway Security Configuration
# kong.yml - Declarative Kong configuration with security plugins_format_version:"3.0"services:-name:user-serviceurl:http://user-service:8080routes:-name:user-apipaths:-/api/v1/usersmethods:-GET-POST-PUT-PATCH-DELETEstrip_path:falseplugins:# 1. Authentication: JWT validation-name:jwtconfig:uri_param_names:-jwtheader_names:-Authorizationclaims_to_verify:-expmaximum_expiration:3600# Max 1 hour token TTL# 2. Rate Limiting-name:rate-limitingconfig:minute:60hour:1000policy:redisredis_host:redisredis_port:6379fault_tolerant:truehide_client_headers:falselimit_by:credential# Per-user, not per-IP# 3. Request Size Limiting-name:request-size-limitingconfig:allowed_payload_size:1# 1 MB maxsize_unit:megabytes# 4. IP Restriction (admin endpoints)-name:ip-restrictionservice:admin-serviceconfig:allow:-10.0.0.0/8-172.16.0.0/12# 5. Bot Detection-name:bot-detectionconfig:deny:-"sqlmap"-"nikto"-"nmap"-"masscan"# 6. CORS Configuration-name:corsconfig:origins:-"https://app.example.com"methods:-GET-POST-PUT-PATCH-DELETEheaders:-Authorization-Content-Typecredentials:truemax_age:3600# 7. Response Transformer - Remove sensitive headers-name:response-transformerconfig:remove:headers:-X-Powered-By-Serveradd:headers:-"X-Content-Type-Options: nosniff"-"X-Frame-Options: DENY"-"Strict-Transport-Security: max-age=31536000; includeSubDomains"-"Content-Security-Policy: default-src 'none'"
Centralized entry point for all API traffic that enforces authentication, authorization, rate limiting, and request validation before routing to backend services
Rate Limiting
Controlling the number of API requests per client within a time window to prevent abuse and ensure fair resource allocation
Request Validation
Verifying that incoming API requests conform to the expected schema (data types, required fields, value ranges) before forwarding to backend services
Mutual TLS (mTLS)
Two-way TLS authentication where both the client and server present certificates, providing strong identity verification for API-to-API communication
WAF Integration
Web Application Firewall rules applied at the API gateway to block common attack patterns (SQLi, XSS, path traversal)
OAuth2/OIDC
Token-based authentication protocols where the gateway validates JWT tokens against an identity provider before allowing access
Tools & Systems
Kong Gateway: Open-source API gateway with extensive plugin ecosystem for security, rate limiting, and authentication
AWS API Gateway: Managed API gateway service with built-in throttling, WAF integration, and Lambda authorizers
Azure API Management: Enterprise API gateway with policy-based security, developer portal, and Azure AD integration
Apigee (Google Cloud): API management platform with threat protection, quota management, and API analytics
Envoy Proxy: High-performance proxy used as API gateway in service mesh architectures with extensive filter chain
Common Scenarios
Scenario: Securing a Microservice API with Kong Gateway
Context: A company is migrating from a monolithic API to microservices. Each microservice has its own REST API. The security team needs to implement centralized authentication, rate limiting, and request validation without modifying each service.
Approach:
Deploy Kong Gateway as the single entry point, routing traffic to 8 backend microservices
Configure JWT validation plugin to verify tokens against the company's Keycloak IdP
Apply rate limiting: 60 requests/minute for regular users, 300/minute for premium users, identified by JWT claims
Enable OAS validation plugin to reject requests that do not match the OpenAPI spec (blocks mass assignment and injection)
Configure mTLS for service-to-service communication behind the gateway
Set up response transformer to remove Server and X-Powered-By headers and add security headers
Integrate with AWS WAF for SQL injection and XSS protection rules
Configure access logging to CloudWatch with security metric filters and alerting
Pitfalls:
Relying solely on the gateway for authorization when backend services also need to verify permissions
Not configuring rate limiting per authenticated user (per-IP only allows attackers to bypass with IP rotation)
Using verbose error responses from the gateway that reveal internal service architecture
Not testing the gateway configuration with security tools after deployment
Missing mutual TLS between the gateway and backend services, allowing direct backend access
