Development of a custom, lightweight API gateway in Java for secure access management and routing in REST APIs.

Abstract

This proposal outlines the design and development of a Java-based software artifact implementing a custom API Gateway to manage security and access control, replacing the need for JWT token systems. The proposal encompasses the definition of functional requirements, software design and architecture, implementation, and system deployment, aiming to offer a secure and efficient solution for communication and control between clients and a REST API. The Design Science Research (DSR) methodology was applied, focusing on the design and implementation process of the software product, which enables secure integration between a client and a REST API. Security in web applications and REST API architectures is essential to protect system integrity, confidentiality, and availability in an increasingly threat-exposed digital environment. Additionally, the Scrum methodology facilitates agile and collaborative project management, ideal for iteratively and adaptively implementing security solutions. During the design and coding phases in Java, the custom API Gateway is defined to manage incoming requests and safely route traffic to REST APIs. The custom API Gateway incorporates features such as authentication, user role validation, and request logging. Simple endpoints are created on the REST API to ensure seamless communication with the gateway. This proposal provides a robust solution for managing security and access control in distributed applications. By using the API Gateway instead of JWT tokens, the system centralizes security and authentication efficiently, enhancing fault tolerance and maintaining stable performance.