Untitled Lesson
Skill Matrix
UNLOCK NODES BY LEARNING NEW TAGS.
Why is centralizing authentication and rate limiting at the API Gateway generally preferred over implementing them separately in each backend service?
💻 Code Challenge | +75 XP
Implement a gateway endpoint that fans out to three downstream services in parallel using Promise.all, aggregates their responses into one payload, and applies a single shared authentication middleware before any downstream call.
A mobile client is making three separate slow round-trips to assemble one dashboard screen, causing a poor experience on slow connections. Reorder the steps to fix this with a gateway aggregation endpoint.
Task: Reorder the blocks in logical sequence to solve the problem.
A.D.A. Interface
Adaptive Didactic Assistant
Pascual Vila
Frontend Instructor // Code Syllabus
The Error //
Duplicating authentication logic separately across every individual backend service instead of centralizing it at the gateway
// Wrong: duplicated across every service, prone to drift
// user-service: implements JWT verification
// order-service: implements its own (possibly slightly different) JWT verification
// Correct: implemented once, centrally
app.use(authenticateJWT); // in the gateway onlyThe Solution //
Each service independently implementing authentication logic means N separate places that can drift out of sync or contain subtly different bugs over time. Centralizing authentication once at the gateway, with downstream services trusting requests that already passed through it, is both more consistent and easier to update.
The Error //
Running only a single gateway instance with no redundancy
// Risky: one gateway instance, one point of failure for EVERYTHING
// Correct: multiple redundant instances behind a load balancer
replicas: 3 // gateway deployment, not just the backend servicesThe Solution //
Since every client request passes through the gateway, it becomes a single point of failure for the entire system — if that one instance goes down, every backend service becomes unreachable even if they themselves are perfectly healthy. Run multiple redundant gateway instances behind a load balancer, with the same reliability rigor applied to any other critical production component.