So, for API Gateway security, my main focus is on a few key areas.

hey everyone im architecting a new system with a microservices backend and an api gateway in front im thinking about how to best secure it should authentication and authorization primarily live at the gateway or should each microservice handle its own what patterns or tools are you using to manage this especially considering things like jwt validation rate limiting and preventing abuse im curious to hear your real world experiences and best practices