API gateway
When the frontend applications interact with their BFF component they will do so through an API gateway and pass along the JWT token from their local storage in the authorization header. This is a bearer token, which means that it is critical to communicate over HTTPS so that the token cannot be intercepted. This will not be a problem since API gateways typically require the use of HTTPS.
The API gateway acts as a barrier at the edge of the system and is responsible for verifying the signature of the bearer token. If you are using the federated identity management service of your cloud provider then the turnkey integration with the API gateway will likely be all that you need to secure your API at this layer. This turnkey integration ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access