阅读中文版本

API Gateway Configuration Review Workflow

Review routes, auth, timeouts, and rate limits at the gateway, remove unused routes, and confirm the gateway does not silently weaken backend protections.

Overview

Keep the API gateway configuration minimal, correct, and consistent with backend security. Confirm unused routes are gone and that an unauthenticated request to a protected route is rejected at the gateway.

Steps

1. Inventory routes and remove those with no traffic or owner. Expected state: The gateway matches reality.
2. Review authentication and authorization at the gateway versus the backend. Expected state: No route bypasses required auth.
3. Check timeouts, retries, and rate limits are set deliberately. Expected state: Behavior is not left at defaults.
4. Test that a blocked request is blocked at the gateway, not only in docs. Expected state: Protection is verified.

routes:
  - path: /api/orders
    upstream: orders
    auth: required
    timeout: 5s
    rateLimit: { requests: 50, period: 1s }

Verification

• A gateway configuration with only used routes, deliberate auth and limits, and verified protection.

Decision points

• Auth at the gateway or the backend? Options: Backend authoritative; Gateway only. Recommended: Backend authoritative; the gateway can add a layer but must not be the only check.
• Default allow or default deny routes? Options: Default deny; Default allow. Recommended: Default deny with explicit routes; default allow leaks new services into public reach.