Auth and TLS at the gateway
Check each token once at the API Gateway, hand password hashing to an Auth Provider, and let a certificate manager renew TLS, so the front door stops costing the App Server and stops expiring.
Validate every token once at the API Gateway, keep password hashing off the App Server, and renew TLS certificates by machine.
Move up when#
Every service re-checks the same token on every request, and the App Server's CPU shows it.
Logins are among the most expensive request kinds, because a password hash costs far more than a page view.
A Certificate expired banner has taken a Node down, because someone forgot a renewal date.
The Design#
Drag to pan. Hold Ctrl or Cmd and scroll to zoom.
| Where | Setting | Value | Why |
|---|---|---|---|
| API Gateway | Auth at the edge | On | The gateway checks each token once, so the App Server skips the check on every request that carries one. |
| API Gateway | Rate limit | 2500 | A cap above real demand costs nothing, and it fails a flood as throttled before it reaches the App Server. |
| App Server | Instance size | medium | Medium leaves room for the password hash that each login still costs. |
| Database | Instance size | medium | Match the App Server so neither tier hides the other. |
Research this Design needs: API gateway, Certificate automation, Managed identity, Load balancing.
Users reach the API Gateway, which checks the token and passes the request to the App Server. The App Server calls the Database for data and the Auth Provider for logins. The Secrets and Certificates Node carries no traffic. It owns the calendar for every certificate on the Board.
Why it works#
Every kind except anonymous pages and the login itself carries a token. Without the gateway check, each service validates it on every request. With Auth at the edge, the gateway validates it once and the services skip that step.
The Auth Provider is a Managed Component, so it hashes passwords for you and bills per user. The Gateway, Load Balancer, CDN, WAF, Realtime Hub and Edge Function each hold a certificate. The manager renews each one well before it expires.
What it costs#
The gateway adds a hop to every request and bills per request, so it is cheap when quiet and dear under load. The rate limit fails real users as throttled if you set it below demand. The Auth Provider is an outage you cannot fix, and a manager that is down renews nothing. The game has no key rotation or OAuth flow, so the Board shows only the check, the hash and the renewal.
In Quorum#
Place an API Gateway, an Auth Provider and Secrets and Certificates. Research API gateway, Managed identity and Certificate automation. The Certificate expired incident is the failure this prevents. See bcrypt and TLS certificates. The next rung, feature flags and CI, limits what a bad deploy can break.