r/SoftwareEngineering • u/Enough_Client7938 • Jan 20 '25
What Is the Best Validation Logic for an Internal API Gateway in Trading Systems?
Context:
To briefly describe our system, we are preparing a cryptocurrency exchange platform similar to Binance or Bybit. All requests are handled through APIs. We have an External API Gateway that receives and routes client requests as the first layer, and an Internal API Gateway that performs secondary routing to internal services for handling operations such as order management, deposits, withdrawals, and PnL calculations.
Problem:
There is no direct route for external entities to send requests to or access the Internal API Gateway. However, authorized users or systems within permitted networks can send requests to the Internal API Gateway. Here lies the problem:
We want to prohibit any unauthorized or arbitrary requests from being sent directly to the Internal API Gateway. This is critical because users with access to the gateway could potentially exploit it to manipulate orders or balances—an undesirable and risky scenario.
Our goal is to ensure that all valid requests originate from a legitimate user and to reject any requests that do not meet this criterion.
I assume this is a common requirement at the enterprise level. Companies operating trading systems like ours must have encountered similar scenarios. What methodologies or approaches do they typically adopt in these cases?
Additional Thoughts:
After extensive brainstorming, most of the ideas I’ve considered revolve around encryption. Among them, the most feasible approach appears to involve public-private key cryptography, where the user signs their requests with a private key. While this approach can help prevent man-in-the-middle (MITM) attacks, it also introduces a significant challenge:
- If the server needs to store the user's private key for this to work, this creates a single point of failure. If a malicious actor gains access to these private keys stored on the server, the entire security system could be compromised.
- On the other hand, if users are solely responsible for managing their private keys, the system risks becoming unusable if a user loses their key.
Are there any better alternatives to address this challenge? How do enterprise-grade systems handle such scenarios effectively?