API Gateway 模式

// Ocelot Gateway 設定（ocelot.json）
{
  "Routes": [
    {
      "DownstreamPathTemplate": "/api/orders/{everything}",
      "DownstreamScheme": "http",
      "DownstreamHostAndPorts": [
        { "Host": "order-service", "Port": 80 }
      ],
      "UpstreamPathTemplate": "/api/orders/{everything}",
      "UpstreamHttpMethod": [ "GET", "POST" ],
      "AuthenticationOptions": {
        "AuthenticationProviderKey": "Bearer"
      },
      "RateLimitOptions": {
        "ClientWhitelist": [],
        "EnableRateLimiting": true,
        "Period": "1m",
        "Limit": 100
      }
    }
  ]
}
 
// Program.cs
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddOcelot();
builder.Services.AddAuthentication("Bearer")
    .AddJwtBearer("Bearer", options =>
    {
        options.Authority = "https://auth.myapp.com";
        options.Audience = "api";
    });
 
var app = builder.Build();
await app.UseOcelot();
app.Run();

// Express Gateway with custom middleware
import express from "express";
import { createProxyMiddleware } from "http-proxy-middleware";
import rateLimit from "express-rate-limit";
 
const app = express();
 
// Rate Limiting
const limiter = rateLimit({
  windowMs: 60 * 1000, // 1 分鐘
  max: 100,
  standardHeaders: true,
});
app.use(limiter);
 
// JWT 認證 middleware
app.use(async (req, res, next) => {
  const token = req.headers.authorization?.split(" ")[1];
  if (!token) return res.status(401).json({ error: "Unauthorized" });
  try {
    req.user = await verifyJwt(token);
    next();
  } catch {
    res.status(401).json({ error: "Invalid token" });
  }
});
 
// 路由到微服務
app.use("/api/orders", createProxyMiddleware({
  target: "http://order-service:3001",
  changeOrigin: true,
}));
 
app.use("/api/payments", createProxyMiddleware({
  target: "http://payment-service:3002",
  changeOrigin: true,
}));
 
// 回應聚合（BFF 模式）
app.get("/api/dashboard", async (req, res) => {
  const [orders, stats] = await Promise.all([
    fetch("http://order-service:3001/api/orders/recent").then(r => r.json()),
    fetch("http://analytics-service:3003/api/stats").then(r => r.json()),
  ]);
  res.json({ orders, stats });
});
 
app.listen(3000);

# FastAPI Gateway
from fastapi import FastAPI, Request, HTTPException
from fastapi.middleware.cors import CORSMiddleware
import httpx
from slowapi import Limiter
from slowapi.util import get_remote_address
 
app = FastAPI()
limiter = Limiter(key_func=get_remote_address)
 
# CORS
app.add_middleware(CORSMiddleware,
    allow_origins=["https://myapp.com"],
    allow_methods=["*"], allow_headers=["*"])
 
# 路由表
SERVICE_MAP = {
    "/api/orders": "http://order-service:8001",
    "/api/payments": "http://payment-service:8002",
    "/api/inventory": "http://inventory-service:8003",
}
 
@app.api_route("/api/{service}/{path:path}", methods=["GET", "POST", "PUT", "DELETE"])
@limiter.limit("100/minute")
async def gateway(request: Request, service: str, path: str):
    target = SERVICE_MAP.get(f"/api/{service}")
    if not target:
        raise HTTPException(status_code=404, detail="Service not found")
 
    # 轉發請求
    async with httpx.AsyncClient() as client:
        response = await client.request(
            method=request.method,
            url=f"{target}/api/{service}/{path}",
            headers=dict(request.headers),
            content=await request.body(),
            timeout=5.0,
        )
    return Response(content=response.content,
                    status_code=response.status_code,
                    headers=dict(response.headers))