ExpressGateway / express-gateway

A microservices API Gateway built on top of Express.js
https://www.express-gateway.io
Apache License 2.0
2.97k stars 344 forks source link

[Question] "isolated" authentication between api gateway and rest apis #991

Open seanyangsg opened 4 years ago

seanyangsg commented 4 years ago

Does express-gateway support "isolated" authentication between api gateway and multiple rest api services?

use case scenario: Overall setup: web and mobile clients with one api gateway that connects to multiple rest api services.

Use jwt token authentication between client and api gateway, all the authentication and authorization checking is done at gateway level, do not pass the jwt token (between client and gateway) to downstream rest api.

Use different authentication methods between api gateway and rest api services. Different rest api requires different authentication and authorization methods; for example, rest api A requires basic auth, rest api B requires jwt token authentication.

Observations: (please correct me if wrong) it seems the client's request Authorization header is always pass to downstream rest api service. and the request transform only happens between client and api gateway, no way to do request transform between gateway and rest api.

Does express-gateway support such use case? if yes, how. if no, kindly share some alternative solutions or ways to go around. thanks!!!