The (API) gateway to hell: Fixing a decade of poor API design decisions
summary
Mews runs a decade‑old connector API (introduced 2015) with 1500 integrations producing 36M+ requests/day; the monolith handles auth and rate limiting so LB autoscaling simply spins up instances that immediately get rate‑limited. An API gateway is added to enforce rate limits and auth, but ASP.NET URL normalization and a permissive JSON parser (accepting trailing commas and case‑insensitive keys) break real clients. Auth-in-body parsing proves unsafe, so the team moves to header auth, tightens input handling, and adopts Hyrum’s law‑driven strictness.
AI-written summary · about
related talks
28mAPI Gateway: critical component of your digital architecture
36m10 Things You Hate About Your API Gateway
26mAPI Gateway, A Success Story
27mMaster API Gateways: Boost Your Microservices Strategy
20mAPI Gateway in a Nutshell
23mLessons from Building an API Management Platform
54mFive-step plan for securing your APIs
42mAPI Gateways - The Good, the Bad and the Ugly