Infrastructure & API

API Security Gateway

A high-performance reverse proxy equipped with an intelligent policy engine and WAF-lite capabilities to protect internal microservices.

The challenge

Exposing internal microservices directly to the public internet creates a massive attack surface. The client needed a centralized way to validate incoming requests, enforce rate limits, and block malicious payloads before they reached the application layer.

The solution

We developed a custom API gateway in Go. It acts as a reverse proxy that intercepts all traffic, validates JWT signatures against a JWKS endpoint, and performs strict JSON schema validation on request bodies. The built-in WAF-lite engine detects and drops SQL injection and XSS attempts in real-time with sub-millisecond latency.