advanced

API gateway routing and auth delegation

Route by host, path, version, tenant, and service health while delegating authentication context without replacing authorization checks.

Gateways route by host, path prefix, API version, headers, or tenant slug. Health-aware routing removes bad upstreams. Auth delegation validates JWTs or introspects opaque tokens, then forwards trusted claims — typically as internal headers services must not accept from the public internet.

					Authorization: Bearer <jwt>
        ↓ gateway validates signature, iss, aud, exp
X-User-Id: 42        (internal network only)
X-Tenant-Id: acme

Services still enforce authorization: authentication proves identity; authorization decides permitted actions on resources.

On interviews: design multi-tenant routing; prevent header spoofing by stripping external `X-User-Id`; canary releases via weighted routes.

Common pitfalls: trusting client-supplied tenant IDs; gateway doing role checks that drift from service policies; stale JWKS cache after key rotation.

The trade-off is balancing simplicity, performance, safety, and operability — name which axis you optimized and what cost you accepted.

Checklist:

Validate tokens at the gateway with cached JWKS.
Strip untrusted identity headers at the perimeter.
Enforce RBAC/ABAC in each service.
Support blue/green or canary route weights.