How to Design an API Gateway

1. What Is an API Gateway

• Gateway = router + filter.
  • Router: the entry point for external requests (a single entry point). Microservices are generally deployed on an internal network. All external requests first pass through the gateway, which forwards them to backend servers (service routing).
  • Filter: rate limiting and circuit breaking, security authentication, log monitoring, etc.

2. Why an API Gateway Is Needed

• Extract common logic.
  • Code such as authorization and authentication has to be implemented in every service. With a gateway, cross-cutting functions such as authorization and authentication can be implemented in the gateway.
• Provide a unified entry point for different clients and avoid forming a mesh structure.
  • Without a gateway, clients connect directly to every microservice.

3. How to Implement an API Gateway

3.1. How to Forward Requests

• Work together with the service registry.
• 

3.2. How to Filter Requests

• Chain of responsibility.

3.3. I/O Model

• If backend services are CPU-intensive, synchronous blocking is sufficient.
• If backend services are I/O-intensive, use asynchronous processing or I/O multiplexing.
• I/O Models.md

4. API Gateway Components

4.1. Spring Cloud Zuul

Zuul.md

4.2. Spring Cloud Gateway

Gateway.md

4.3. Tyk

4.4. Kong

5. Patterns

5.1. BFF

5.2. Gateway Aggregation Pattern

6. References

• Open API Gateway Practice (1) — Designing an API Gateway
• Open API Gateway Practice (2) — Replay Attacks and Defenses
• Open API Gateway Practice (3) — Rate Limiting
• Microservice Architecture: “API Gateway” - CNBlogs