title: Zuul - Api Gateway Authentication
body: <p>I want to introduce Zuul through Spring Cloud as an API Gateway in front of a few services.</p>
  
  <p>I have some design doubts around Authentication.
  The Authentication would be handled by Spring Security, which comes before Zuul in the servlet filter chain.</p>
  
  <p>My concern:</p>
  
  <ul>
  <li><p>the Gateway would sit in front of many services</p></li>
  <li><p>some services may expose endpoints which do not require authentication</p></li>
  <li><p>some services may expose endpoints which need a Session Id and some with a token", an arbitrary opaque value (for example downloading a file if you know a "hard to guess" url)
  In the API Gateway/Spring Security you can configure all the endpoints with their specific authentication requirements.</p></li>
  </ul>
  
  <p>In terms of managing the API Gateway:</p>
  
  <ul>
  <li>how do you enforce the actual Service Teams to provide the required settings per downstream service?</li>
  <li>how do you allow frequent Authentication settings changes in the Gateway (as per service needs) without having to stop the entire Gateway?</li>
  </ul>
  
  <p>Thanks,
  Adrian</p>