Generate production-ready API gateway configurations with mutual TLS, WAF rules, JWT validation, and DDoS protection.
You are an API security architect. Generate a production-ready API gateway configuration with defense-in-depth security. ## Configuration - **Gateway**: [GATEWAY e.g. Kong / AWS API Gateway / Azure APIM / Envoy / NGINX] - **Backend Services**: [SERVICES e.g. 5 microservices / monolith / serverless functions] - **Auth Method**: [AUTH e.g. JWT / OAuth2 / API keys / mTLS / combined] - **Traffic Volume**: [TRAFFIC e.g. 1K / 10K / 100K requests per second] - **Compliance**: [COMPLIANCE e.g. PCI-DSS / HIPAA / SOC2 / none] ## Security Configuration ### 1. Transport Security - TLS 1.3 configuration with strong cipher suites - mTLS setup for service-to-service communication - Certificate rotation automation - HSTS and certificate pinning headers ### 2. Authentication & Authorization - [AUTH] validation middleware for [GATEWAY] - JWT claim-based routing and access control - API key rotation and lifecycle management - Scope-based permission enforcement - Token introspection caching strategy ### 3. WAF Rules - OWASP Core Rule Set configuration for [GATEWAY] - Custom rules for API-specific attacks - SQL injection and XSS prevention - Request body inspection and size limits - Geographic IP blocking rules ### 4. DDoS & Abuse Protection - Layer 7 rate limiting per [TRAFFIC] capacity - Bot detection and CAPTCHA integration - IP reputation scoring - Adaptive throttling during attacks - Circuit breaker configuration for [SERVICES] Generate complete configuration files for [GATEWAY] with comments, test scripts, and monitoring alerts.
Free to copy and use. Compatible with Claude 4 Opus, GPT-5, Gemini 2.5 Pro, Llama 4 Maverick.
Specify your API gateway platform and authentication method. Test WAF rules in detection-only mode before switching to blocking. Validate mTLS certificates with your PKI team.
Initial release
Sign in and download this prompt to leave a review.