I have a bunch of microservices that are only accessible externally via an API Gateway.
My API Gateway is set up as an OAuth Resource and validates the token (Checks signature etc.) before passing the request downstream to one or more microservices.
Whilst my microservices need the token in order to verify scopes and claims, is there any need now for this service to validate the token as well?
It seems a bit overkill yet I cannot find any advice online about this scenario.
Is validating the token at the API gateway good enough? Or is it best practice to validate it again later?
I cannot find any advice online about this scenario.
Because it depends on several factors that vary from project to project. Probably in most of the developments out there claiming to be MS architecture, they don't need it. Moreover, within such architectures, there should be an auth server that will do this instead of the services (and instead of the gateway of course). Is the auth server who allow the request to pass or not.