API / Apollo Gateway Interview questions
How do you secure inter-service communication between the gateway and subgraphs?
Subgraphs generally shouldn't be reachable from anywhere except the gateway, and the gateway's own calls should be authenticated as coming from a trusted source.
- Network isolation – place subgraphs on a private network or VPC so they aren't publicly addressable at all; only the gateway/router has network access to them.
- Shared-secret or mTLS validation – have each subgraph check for a shared secret header or client certificate on incoming requests, rejecting anything that didn't come from the gateway.
- Forward and validate end-user auth – pass along the end user's token/claims (as covered under authentication) so subgraphs can still make per-user authorization decisions, not just "is this the gateway."
- Rotate internal service credentials regularly, the same as any other service-to-service credential.
- Rate limit at the gateway edge so a single misbehaving client can't flood every subgraph downstream.
These layers are complementary — network isolation stops opportunistic external access, while the shared-secret/mTLS layer stops a compromised service on the same network from impersonating the gateway.
What is the purpose of placing subgraphs on a private network or VPC?
Why is forwarding end-user auth claims to subgraphs still necessary even with gateway-to-subgraph authentication in place?
More Related questions...
