I have a bunch of microservices that are only accessible externally via an API Gateway.
My API Gateway is set up as an OAuth Resource and validates the token (Checks signature etc.) before passing the request downstream to one or more microservices.
Whilst my microservices need the token in order to verify scopes and claims, is there any need now for this service to validate the token as well?
It seems a bit overkill yet I cannot find any advice online about this scenario.
Is validating the token at the API gateway good enough? Or is it best practice to validate it again later?