🔐 Is Your Microservice Secure? Learn to Restrict API Calls to Gateway Only! 🚀 | .NET 8 & Ocelot 🌟

In our previous blog (🔗 Hassle-Free API Management: Use Ocelot for Smooth Microservice API Gateway & Simplify Your Life! 🚀🎯), we explored how to build and configure an API Gateway using Ocelot in .NET 8 microservices. Today, we're taking it a step further by ensuring that each web API in our microservice architecture listens ONLY to the API Gateway. This means we'll configure our services to reject any API call coming from outside the gateway address and port. This setup is crucial for maintaining a secure and efficient microservice environment. Let's dive in and see why this is important and how you can implement it!

Scenario Example: Imagine a scenario where you have multiple microservices handling sensitive data. Without restricting access to the API Gateway, a malicious actor could directly target these services, potentially compromising data security. By ensuring all requests go through the API Gateway, you add an additional layer of security, protecting your microservices from direct exposure.

Why This is Important

In a microservice architecture, having a centralized API Gateway like Ocelot helps manage and route requests efficiently. However, it's vital to ensure that all external traffic goes through this gateway. Allowing direct access to individual services can lead to security vulnerabilities, inconsistent traffic handling, and potential misuse of resources. By restricting access to each service and ensuring they only accept requests from the API Gateway, we can:

• Enhance Security: Prevent unauthorized access and potential attacks on individual services.
• Simplify Traffic Management: Ensure all traffic policies, such as rate limiting and load balancing, are applied consistently.
• Maintain Service Integrity: Protect services from being overwhelmed by direct requests, which could bypass essential gateway-level controls.

Steps to Implement

1. Identify the Gateway Address and Port: Determine the IP address and port of your API Gateway.
2. Configure Each Service: Update the configuration of each web API to accept requests only from the identified gateway address and port.
3. Implement Firewall Rules: Use firewall rules or network security groups to block any traffic to the services except from the gateway.
4. Test the Configuration: Ensure that requests from the gateway are processed correctly while direct requests to the services are rejected.

 # Create Middleware To Modify all Request Through the Gateway

namespace Gateway.Middlewares
{
    public class InterceptionMiddleware(RequestDelegate next)
    {
        public async Task InvokeAsync(HttpContext context)
        {
            context.Request.Headers["Referrer"] = "Api-Gateway";
            await next(context);
        }
    }
}

 # Use The Middleware

app.UseMiddleware<InterceptionMiddleware>();

 

# Create Middleware to Verify the Request Coming from Gateway 

using Microsoft.AspNetCore.Http;

namespace SharedLibrary
{
    public class RestrictAccessMiddleware(RequestDelegate next)
    {
        public async Task InvokeAsync(HttpContext context)
        {
            var referrer = context.Request.Headers["Referrer"].FirstOrDefault();
            if (string.IsNullOrEmpty(referrer))
            {
                context.Response.StatusCode = StatusCodes.Status403Forbidden;
                await context.Response.WriteAsync("Hmmm, Can't reach this page");
                return;
            }
            else
            {
                await next(context);
            }
        }
    }
}

 # Use this middleware in Various Services.

app.UseMiddleware<RestrictAccessMiddleware>();

Conclusion

You now have a robust setup where each of your microservices communicates exclusively through the API Gateway. This approach not only fortifies the security of your architecture but also ensures a more streamlined and manageable traffic flow. Don't forget to subscribe to the Netcode-Hub Channel for more tutorials and tips on mastering microservices and other .NET technologies. Let's get started!