Security and traffic governance
The platform's governance capabilities are front-loaded at the ApiGo Gateway: all open traffic passes through a unified governance chain, keeping backend services stable.
Gateway filter chain
Rate limiting and circuit breaking
Implemented on Sentinel; rules are stored in Redis and refreshed dynamically without restart:
- Rate limit rules: QPS flow control, with rules bound to APIs
- Circuit breaking and degradation rules: circuit breaking triggered by exception ratio / slow call ratio to protect backends
- Rule consistency across cluster deployments
Response caching
CacheFilter supports 4 cache key rules:
| Rule | Key composition | Use case |
|---|---|---|
| Fixed key | apiId_method_path | Identical response for all requests |
| All parameters | apiId_method_path_sortedParams | Independent cache per parameter set |
| Request body | apiId_method_path_md5(body) | POST queries |
| Specified parameters | apiId_method_path_specifiedParams | Cache only by key parameters |
Request body caching is limited to 100KB by default; larger bodies skip the cache and are forwarded directly.
IP access control
- Black/whitelist: configure IP blacklist / whitelist rules per API
- Credential IP whitelist: app-level whitelist; requests from non-whitelisted origins return
40018
WAF protection
Built-in WAF detection:
- SQL injection pattern recognition
- XSS attack interception
- Path traversal attack interception
Requests that hit an illegal pattern are blocked directly (HTTP 400) and logged.
Authentication and authorization
| Authentication method | Description |
|---|---|
none | Public APIs are passed through directly |
app_key | Simple authentication; the X-AppKey header is compared against the authorized app list |
app_secret | HMAC signature authentication (SM3 / HmacSHA256), tamper-proof and replay-proof |
oauth2 | OAuth2 client credentials with Bearer tokens; tokens are short-lived and can be revoked immediately |
jwt | Enterprise IdP JWT: JWKS signature verification and app binding by (jwtIdp, subject), with standard 401/403/503 |
JWT authentication additionally enforces audience validation (aud must match the configuration), exact issuer matching, an algorithm allowlist, and JWKS key rotation handling. After successful authentication, the gateway strips Authorization, X-AppKey, X-Timestamp, X-Nonce, X-Sign, and client-spoofable identity headers, and does not inject identity downstream by default, preventing token passthrough and identity spoofing.
For the signature algorithm, see the signature authentication guide; for token exchange and calls, see OAuth2 client credentials authentication; for enterprise IdP integration, see Enterprise IdP JWT authentication.
Alert notifications
Alert rules support:
- Trigger conditions: request timeout, abnormal status code, error rate over threshold, consecutive failures
- Notification channels: email, SMS, Webhook
- Alert records: all triggered records can be queried with pagination, closing the handling loop
Permission and security system
- RBAC permission model: fine-grained authorization for users / roles / menus
- Project isolation: APIs, data sources, and apps are isolated by project space
- Chinese national cryptographic algorithms: SM3 for signatures, SM2/SM4 for encryption
- Multi-environment isolation: development / test / production environments are released and accessed independently
- SSO integration: WeCom, DingTalk, and Feishu single sign-on
- Operation audit: full recording of system operation logs