Why Microservices Need an API Gateway: Solving Cross-Cutting Concerns Without Code Duplication

What Is a Service Gateway

服务网关 = 路由转发 + 过滤器

A service gateway combines two core capabilities: routing and filters .

Routing : Receives all external requests and forwards them to backend microservices.

Filters : Implements cross-cutting functions such as authentication, rate limiting, and monitoring. Routing itself is also implemented via filters.

Why a Service Gateway Is Needed

Cross-cutting concerns (e.g., authentication) can be placed in three locations:

Each service implements its own — obvious code duplication, rarely used.

A shared library/service — eliminates duplication but introduces two drawbacks:

Every service's JAR grows larger because the shared code is packaged inside each service. This is especially problematic for Docker deployments where smaller images are preferred.

Upgrading the shared library becomes difficult. Changing the authentication logic requires rebuilding and redeploying every service that depends on it.

Gateway pre-filters — the gateway handles authentication centrally. Backend services contain no authentication code, so JARs stay small. Updating authentication logic only requires modifying the gateway filter; no service redeployment is needed.

Therefore, a service gateway is essential.

Architecture After Introducing a Gateway

The architecture comprises three parts: Gateway , open-service (external-facing aggregation layer), and service (internal services).

Overall Flow

Gateway, open-service, and services register with the service registry (Consul) at startup.

Clients call the gateway. The gateway performs intelligent routing (service discovery + load balancing) to open-service, applying authentication, monitoring, and rate limiting.

open-service aggregates responses from internal services and returns them to the gateway, which forwards the result to the client.

Considerations When Adding a Gateway

Performance overhead : One extra network hop (gateway → open-service). The impact is small because gateway machines are typically powerful and communication occurs over the internal network.

Single point of failure : Every call chain has a single point (gateway, nginx, DNS). Mitigation: place nginx in front of the gateway; nginx rarely fails and allows horizontal scaling of gateway instances.

Nginx vs. Zuul performance : An external benchmark showed negligible difference. Zuul is Netflix's open-source gateway framework.

Keep the gateway lightweight .

Core Gateway Functions

Smart Routing : Forwards only external requests to open-service. Internal service-to-service calls bypass the gateway; therefore full-chain tracing, internal API monitoring, internal fault tolerance, and internal smart routing cannot be done at the gateway. Routing all traffic through the gateway would overload it.

Authentication : Validates only user-to-open-service requests. Internal service calls are not authenticated.

API Monitoring : Monitors requests passing through the gateway and gateway-level metrics (e.g., GC).

Rate Limiting : Works with monitoring to enforce limits.

Unified API Log Collection : Acts like an AOP aspect, logging request entry and exit.

Extended Gateway Functions

A/B Testing : The gateway can implement the traffic-splitting engine, but because splitting logic often calls internal services, it is better placed in open-service rather than the gateway to avoid overloading the gateway.

Technology Stack Selection

Languages : Java + Groovy (Groovy enables dynamic filter addition without gateway restart).

Microservice Framework : Spring Boot.

Gateway Component : Netflix Zuul.

Service Registry : Consul.

Authentication : JWT.

API Monitoring : Prometheus + Grafana.

Unified Log Collection : Logback + ELK.

Load Testing : JMeter.