Node.js微服务API网关：Passport.js实现JWT验证及存储适配咨询

Great questions! Let's break them down one by one:

1. Can API Gateway validate JWT before forwarding requests, even when token issuance is handled by a backend User Service? #

Absolutely! This is a common and fully achievable architecture. The key insight here is that JWT validation doesn't require direct communication with the issuing service—you just need the right verification key (or public key, for asymmetric encryption) configured in the gateway. Here's how to make it work:

• Share the validation key between gateway and User Service:
  • For symmetric encryption (like HS256/HS512), both the User Service (token issuer) and gateway (validator) need access to the same secret string.
  • For asymmetric encryption (like RS256/RS512), the User Service uses a private key to sign tokens, while the gateway stores the matching public key to verify signatures.
• Configure JWT validation in the gateway:
  • Set up a middleware or plugin to extract the JWT from the request header (typically Authorization: Bearer <token>).
  • Validate the token's signature, expiration time (exp claim), and any required custom claims (like iss for issuer or aud for audience) using the shared key.
  • If validation passes, forward the request to the target microservice; if not, return a 401 Unauthorized or 403 Forbidden response right away.
• Optional: Handle token revocation:
  • If you need to check if a token has been revoked (e.g., user logged out), the gateway can query a shared database or cache (like MySQL or Redis) that the User Service updates when tokens are invalidated. This adds minor overhead but is manageable for most use cases.

2. Can Express Gateway be adapted to use MySQL instead of the default in-memory storage? #

Yes, Express Gateway is designed to be highly extensible, so replacing the default in-memory storage with MySQL (or any other database) is totally feasible. The in-memory option is just for quick setup—here's how to switch to MySQL:

• Implement a custom storage adapter:
  • Express Gateway lets you build custom storage adapters that conform to its core storage interface. You'll need to:
    1. Install a MySQL Node.js driver (like mysql2) in your Express Gateway project.
    2. Create a custom adapter module that implements methods like find, create, update, and delete for the resources you need to store (e.g., API keys, routes, credentials).
    3. Update your gateway.config.yml to use this custom adapter instead of the default memory storage.
• Leverage community solutions:
  • While there's no official MySQL plugin, the Express Gateway community has created third-party tools that handle MySQL integration for common use cases. You can build on these or craft your own tailored to your needs.
• Integrate MySQL for JWT-specific data:
  • If you need to store JWT blacklists or user permission data for validation, you can directly connect to MySQL within your gateway's JWT validation middleware to fetch necessary data during the check.

内容的提问来源于stack exchange，提问作者Hashan Darshana