To build a Java-based API gateway, using Spring Cloud Gateway is an efficient and scalable solution. 1. Create a project through Spring Initializr and introduce WebFlux, Gateway, Eureka Client and Actuator dependencies; 2. Configure routing rules in application.yml to support static URI or Eureka-based service discovery dynamic routing; 3. Add global filters to implement JWT authentication, implement current limiting through Redis, limiting 10 requests per second per IP and 20 bursts; 4. Integrate Resilience4j to implement circuit breakers, configure fallback downgrade logic to enhance system flexibility; finally enable Actuator monitoring and SSL and CORS policies to build a complete API gateway with routing, security, current limiting and fault tolerance. The solution is based on a responsive programming model, with excellent performance and easy to scale.

Building an API Gateway with Java and Spring Cloud Gateway is a practical and scalable way to manage microservices communication in a distributed system. Rather than exposing services directly to clients, an API Gateway sits between the client and a collection of backend services, handling routing, authentication, rate limiting, and monitoring in a centralized way.

Spring Cloud Gateway is a lightweight, high-performance API gateway built on Spring Boot and Project Reactor, making it a natural choice for Java-based microservices architectures. Here's how to build one effectively.

1. Set Up the Spring Boot Project

Start by creating a new Spring Boot project using Spring Initializr . Include the following dependencies:

• Spring WebFlux (required for reactive programming)
• Spring Cloud Gateway
• Eureka Discovery Client (if using service discovery)
• Spring Boot Actuator (for monitoring and health checks)

Make sure you're using a compatible version of Spring Cloud. For example, with Spring Boot 3.x, use Spring Cloud 2023.0.0 or later.

 <dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-gateway</artifactId>
</dependency>

Also, add the Spring Cloud dependency management in your pom.xml :

 <dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-dependencies</artifactId>
            <version>2023.0.0</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
    </dependencies>
</dependencyManagement>

2. Configure Basic Routing

The core function of an API Gateway is routing requests to the appropriate microservices. You can define routes in two ways: via configuration ( application.yml ) or Java configuration.

Using application.yml :

 spring:
  cloud:
    gateway:
      routes:
        - id: user-service
          uri: http://localhost:8081
          Predicates:
            - Path=/api/users/**
          filters:
            - StripPrefix=1

        - id: product-service
          uri: http://localhost:8082
          Predicates:
            - Path=/api/products/**
          filters:
            - StripPrefix=1

This configuration:

• Routes /api/users/** to a service running on port 8081
• Removes the first part of the path ( /api ) before forwarding (via StripPrefix=1 )
• Same logic apply for products

You can also use service discovery (eg, Eureka) to make uri dynamic:

 uri: lb://user-service # 'lb' means load-balanced

Ensure you have @EnableDiscoveryClient on your main class if using Eureka.

3. Add Common Gateway Features

An API Gateway isn't just about routing — it's also about cross-cutting concerns.

Global Filters for Authentication

Use a global filter to validate JWT tokens or API keys:

 @Component
public class AuthenticationGlobalFilter implements GlobalFilter {
    @Override
    public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
        String token = exchange.getRequest().getHeaders().getFirst("Authorization");

        if (token == null || !token.startsWith("Bearer ")) {
            exchange.getResponse().setStatusCode(HttpStatus.UNAUTHORIZED);
            return exchange.getResponse().setComplete();
        }

        // Add logic to validate JWT
        // If valid, continue; else, deny

        return chain.filter(exchange);
    }
}

Rate Limiting

Use Redis-based rate limiting with Spring Cloud Gateway:

 <dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-data-redis-reactive</artifactId>
</dependency>

Then configure in application.yml :

 spring:
  cloud:
    gateway:
      routes:
        - id: user-service
          uri: lb://user-service
          Predicates:
            - Path=/api/users/**
          filters:
            - name: RequestRateLimiter
              args:
                redis-rate-limiter.replenishRate: 10
                redis-rate-limiter.burstCapacity: 20
                key-resolver: "#{@userKeyResolver}"

And define a KeyResolver bean:

 @Bean
KeyResolver userKeyResolver() {
    return exchange -> Mono.just(
        exchange.getRequest().getRemoteAddress().getHostName()
    );
}

This limits each IP to 10 requests per second, with a burst of 20.

4. Enable Resilience with Circuit Breaker

Integrate resilience4j or Hystrix to prevent cascading failures.

Add dependency:

 <dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-circuitbreaker-reactor-resilience4j</artifactId>
</dependency>

Apply the filter in routing config:

 filters:
  - name: CircuitBreaker
    args:
      name: userServiceCircuitBreaker
      fallbackUri: forward:/fallback/user

And define a fallback endpoint:

 @RestController
public class FallbackController {
    @GetMapping("/fallback/user")
    public Mono<Map<String, Object>> userServiceFallback() {
        return Mono.just(Map.of(
            "error", "User service is currently unavailable",
            "timestamp", System.currentTimeMillis()
        ));
    }
}

Final Notes

• Logging & Monitoring : Enable Actuator endpoints ( /actuator/gateway/routes , /actuator/gateway/globalfilters ) to inspect gateway state.
• SSL/TLS : Terminate SSL at the gateway level for secure internal communication.
• CORS : Configure CORS policies if serving web clients.

Spring Cloud Gateway gives you a powerful, non-blocking foundation for building a robust API gateway in Java. With minimum configuration, you can handle routing, security, rate limiting, and resilience — all critical in a microservices environment.

Basically, start simple with routing, then layer in filters and resilience as needed. It's not overly complex, but easy to misconfigure if you overlook things like reactive threading or filter order.

The above is the detailed content of Building an API Gateway with Java and Spring Cloud Gateway. For more information, please follow other related articles on the PHP Chinese website!