Is it bad practice to call another API from a Filter?

Question

I am using Java, Spring and Jersey.

I have a REST API A which receives a query parameter called q and sends this to another API B to get a response.

I need to implement a change where I first need to pass the query from the client to another API C and use the response from API C to create a new request, i.e. basically wrap the request in an HttpServletRequestWrapper which has the new q parameter.

Hopefully this image will clarify this a bit:

So the idea is to use a javax.servlet.Filter for this scenario. Few questions that bug me:

1. Is it good practice to call another API from a Filter?

2. I am using Spring. Would it be an issue to use @Autowired for the client of API C within my Filter?

Answer 1

You are doing what is commonly known as Web Service Orchestration. See this related post on StackOverflow about orchestrating micro services.

Using a servlet filter to make a call to an external service is not recommended. According to the Oracle documentation, Filters are supposed to be used to transform the HTTP request or response or both. In this case it is not purely transforming, it is calling an external service which is not under your control, so you need to treat it as a potential failure point.

Filters should be used for transforming formats or logging etc. Put any any external calls should be done in as part of your service orchestration logic.

A limitation of orchestration logic in Filters is that the order in which it called will matter and you will need to be careful to get this order correct. From a code design perspective this make your code more fragile.

Also if you want to later do more complex orchestration of the services with timeouts etc., using filters may be problematic as you may effect other filters in the chain.

Recommended approaches would be use something like Apache Camel or Spring Integration or implement the API Gateway pattern as the above Stack Overflow link suggested.

Answer 2

Generally yes it is not good practice because usually we do not need to call external services for each endpoint and orchestration order changes for different use cases, whereas filter is used for common logic around endpoints.

But look what spring OAuth2ClientAuthenticationProcessingFilter does, it calls authorization server to fetch tokens.

So it boils down to your requirements, and if you are sure about the order of the external call and you have taken care of service resilience, then there shouldn't be any harm.