Cloud-native gateways support route-level WAF protection and multiple routing policies, including throttling, rewrite, header setting, CORS, traffic replication, timeout, and retry, to protect and optimize your services.
Enable route-level WAF protection
Cloud-native gateways are deeply integrated with Alibaba Cloud WAF 3.0. Unlike traditional WAF, this integration allows requests to reach API gateways directly without passing through a separate WAF layer, which improves overall performance without compromising security. For more information, see Enable route-level WAF protection.
Configure policies
|
Policy |
Description |
|
Route-level throttling policies prevent backend services from being overwhelmed by excessive requests and help avoid cascading failures. You can set fine-grained thresholds to limit the number of requests on a route within a specified period, ensuring backend availability. |
|
|
A rewrite policy lets you modify the paths and hostnames in requests before they are forwarded to backend services. This gives you precise control over request routing to meet specific business and architecture requirements. |
|
|
A header setting policy lets you modify headers in requests before they reach backend services, or in responses before they are returned to clients. |
|
|
CORS is a security mechanism that enables web servers to perform cross-origin access control for secure data transfer. Cloud-native gateways support route-level CORS policies, allowing you to specify which domain names and request methods can access your resources. |
|
|
Cloud-native gateways support route-level authentication. For more information about how to configure consumer authentication, see Configure consumer authentication. |
|
|
A traffic replication policy copies live traffic from a route to a specified application. This supports simulation testing and fault diagnosis, helping you evaluate application performance and troubleshoot issues efficiently. |
|
|
Route-level timeout policies define how long a gateway waits for a backend response. If no response is received within the specified period, the gateway returns a 504 (Gateway Timeout) HTTP status code to the client. |
|
|
Route-level retry policies enable cloud-native gateways to automatically retry failed requests. You can specify retry conditions such as connection failures, unavailable backend services, or specific HTTP status codes. |