Skip to content

Ocelot API Gateway

🧭 Responsibilities of This Gateway

  • Request routing to downstream services
  • Centralized authentication and authorization
  • Rate limiting and request throttling
  • API aggregation (where applicable)
  • Observability (logging, tracing, correlation IDs)

🚫 Non-Responsibilities

  • Business logic
  • Data access
  • UI rendering
  • Certificate or TLS management
  • The gateway must remain stateless and thin.

🔐 Security Considerations

  • Authentication is enforced at the gateway level (e.g., JWT, Entra ID)
  • Authorization policies are applied per route
  • Secrets and sensitive configuration must be injected via environment variables
  • No secrets should be stored in route configuration files

🌱 Route Configuration Strategy

  • Route definitions are split by environment to ensure:
  • Clear separation of concerns
  • Safer production deployments
  • Predictable behavior per environment

(ASP.NET Core + Ocelot)

This project implements an API Gateway using Ocelot on ASP.NET Core, acting as an internal gateway responsible for routing, aggregation, security enforcement, and observability.

apigateway-ocelot/
│
├─ .vs/                                 # Visual Studio local settings (not versioned)
│
├─ bin/                                 # Compiled binaries (generated)
├─ obj/                                 # Build artifacts (generated)
│
├─ Controllers/                         # Optional controllers (health, diagnostics)
│
├─ Properties/
│  └─ launchSettings.json               # Local launch configuration
│
├─ .dockerignore                        # Docker ignore rules
├─ .env                                 # Local environment variables (not committed)
├─ .env.sample                          # Environment variable template
│
├─ ApiGateway.csproj                    # .NET project definition
├─ ApiGateway.sln                       # Solution file
│
├─ Dockerfile                           # Container definition for the gateway
│
├─ Program.cs                           # Application entry point
├─ Startup.cs                           # Service registration and middleware
│
├─ README.md                            # Gateway overview and usage
│
├─ route-local.json                     # Ocelot routes for local environment
├─ route-dev.json                       # Ocelot routes for development environment
├─ route-dockercontainer.json           # Routes for containerized execution
└─ route-prod.json                      # Ocelot routes for production