Get the most recent info and news about Gateway on HackerNoon, where 10k+ technologists publish stories for 4M+ monthly readers.

Gateway

gateway

Tricon Garage driver Corey Heim won his fourth NASCAR Craftsman Truck Series race of 2024 at World Wide Technology Raceway.

Corey Heim dominates Gateway for fourth Truck Series win of 2024

My developer friends, how are we all doing? 👋 I am certain that just like all of us, the management of microservices was a headache for you. After all, it is an unparalleled endeavor. Congratulations, you’ve accomplished the arduous task of tearing your monolith into separate services. That’s awesome! Unfortunately, we have a web of disparate API calls, authentication problems, and traffic storms. Do you relate? In these situations, API gateways are useful. You can think of them as fences around your microservices world. They manage the chaos, letting your services concentrate on their assigned jobs. In this post, I will cover the most common patterns, tools, and challenge areas, so you don’t have to spend time tackling them yourself. Let’s get right to it! What Is the Importance of API Gateways? Imagine this for a second: You have 20 microservices to deal with, each having their very own API, authentication logic and rate limits. Now, coordinating all of this with web, mobile and third-party clients? That's downright nightmare inducing, huh? An API gateway functions as the main entry point through which all requests are supposed to go. It manages: Routing: The User Service is routed for guy “/users” and Order Service for “/orders”.
Security: Auth checks are done only once for all services instead of getting verified continuously.
Traffic Control: Intercept DDoS attacks before they torch your servers.
Transformation: Take that XML response and transform it to JSON for the mobile app. Routing: The User Service is routed for guy “/users” and Order Service for “/orders”. Security: Auth checks are done only once for all services instead of getting verified continuously. Traffic Control: Intercept DDoS attacks before they torch your servers. Transformation: Take that XML response and transform it to JSON for the mobile app. But here’s what is important, not all gateways are the same. Let’s analyze the patterns that will not only preserve your wellbeing, but also the ones that will drain your time and energy. Important API Gateway Patterns: A guide for developers Important API Gateway Patterns: A guide for developers 1. Backend for Frontend (BFF): Your Frontend’s Best Buddy 1. Backend for Frontend (BFF): Your Frontend’s Best Buddy What it solves: How many times did you have to change the API because the mobile team wanted one form while the web team wanted another one? The BFF pattern builds specialized gateways for every sort of client. How It Works: Web BFF: Combines data from various services to enrich dashboard UI with multiple services.
Mobile BFF: Returns small, optimized payloads to help save bandwidth.
Third Party BFF: Restricts external partners to certain endpoints. Web BFF: Combines data from various services to enrich dashboard UI with multiple services. Mobile BFF: Returns small, optimized payloads to help save bandwidth. Third Party BFF: Restricts external partners to certain endpoints. For example, the mobile version of your e-commerce app requires productId, name and price. The web version needs reviews, stock status, and related items. Instead of making a single API to cater all, create two BFFs. # Mobile BFF route  
GET /mobile/products/{id} → Product Service (basic fields)  

# Web BFF route  
GET /web/products/{id} → Product Service + Reviews Service + Inventory Service # Mobile BFF route  
GET /mobile/products/{id} → Product Service (basic fields)  

# Web BFF route  
GET /web/products/{id} → Product Service + Reviews Service + Inventory Service BFF Shared Library - some gotchas BFF Shared Library - some gotchas Duplication: Avoid copy-pasting the logic when auth is needed on both BFFs – it’s best to employ a shared library or sidecar.
Overhead: CI/CD pipelines are required for every BFF you manage. Good luck with 5 BFFs.
Self Check: Do my clients have very dispersed requirements or can they be serviced through one gateway? Duplication: Avoid copy-pasting the logic when auth is needed on both BFFs – it’s best to employ a shared library or sidecar. Duplication: Overhead: CI/CD pipelines are required for every BFF you manage. Good luck with 5 BFFs. Overhead: Self Check: Do my clients have very dispersed requirements or can they be serviced through one gateway? Self Check: 2. Rate Limiting: Stopping Traffic Tsunamis 2. Rate Limiting: Stopping Traffic Tsunamis What it Solves: Prevents the over abuse of your services, like someone using your ‘end-point’ for ‘/checkout’ 1000 times/minute, as well as protecting your bank account from the surprise of the cloud bill. What it Solves: Implementation: Implementation: Token Bucket Algorithm: Users have tokens which they spend to make a request and over time refill them.
IP vs User Based Limits: Block abusive ip addresses or restrict free tier users. Token Bucket Algorithm: Users have tokens which they spend to make a request and over time refill them. IP vs User Based Limits: Block abusive ip addresses or restrict free tier users. Tools in Action: Tools in Action: Kong: The Plugins for rate-limiting and the bot-detection are a goldmine.
AWS API Gateway: Custom API-keys can have quotas and attached plans which control their usage. Kong: The Plugins for rate-limiting and the bot-detection are a goldmine. AWS API Gateway: Custom API-keys can have quotas and attached plans which control their usage. Pro Tip: Fixed intervals are less preferable than sliding windows. If, for example, your limit is 4 requests to make within 60 seconds, let people make short bursts of up to 120 requests within 30 seconds, with the average during the 60 seconds being below 100. Pro Tip: Example Configuration (Kong): Example Configuration (Kong): # Limit to 10 requests/minute per user  
curl -X POST http://localhost:8001/plugins   
  --data "name=rate-limiting"   
  --data "config.minute=10"   
  --data "config.policy=local" # Limit to 10 requests/minute per user  
curl -X POST http://localhost:8001/plugins   
  --data "name=rate-limiting"   
  --data "config.minute=10"   
  --data "config.policy=local" Be Mindful Of: Be Mindful Of: Doubtful Assignments: Real users getting stuck on caps during busy sales for certain periods. Set a limit but let them try again with a helpful optional retry header.
A Worry: Tiers (premium versus free) can be problematic. Doubtful Assignments: Real users getting stuck on caps during busy sales for certain periods. Set a limit but let them try again with a helpful optional retry header. Doubtful Assignments: A Worry: Tiers (premium versus free) can be problematic. A Worry: 3. Authentication & Authorization: Managing Your APIs 3. Authentication & Authorization: Managing Your APIs How It’s Done: What is the strategy for ensuring only authorized people and automated accounts invoke your endpoints? Best Practices: Best Practices: Gate Auth at the Gateway: Validate JWT and OAuth2 credential tokens once.
Claims are Passed: Use headers such as X-User-ID or X-Roles to avoid re-validating by services. Gate Auth at the Gateway: Validate JWT and OAuth2 credential tokens once. Claims are Passed: Use headers such as X-User-ID or X-Roles to avoid re-validating by services. Example Flow: Example Flow: Client → API Gateway → [Auth Service] → "Is this token valid?"  
↓  
If yes: Route request to Service A with `X-User-ID=123`  
If no: Return 401 Unauthorized Client → API Gateway → [Auth Service] → "Is this token valid?"  
↓  
If yes: Route request to Service A with `X-User-ID=123`  
If no: Return 401 Unauthorized Tools: Tools: Istio: Apply policies at the service mesh level using AuthorizationPolicy.


AWS Cognito + API Gateway: Serverless scalable auth. Istio: Apply policies at the service mesh level using AuthorizationPolicy. Istio: Apply policies at the service mesh level using AuthorizationPolicy. AWS Cognito + API Gateway: Serverless scalable auth. AWS Cognito + API Gateway: Serverless scalable auth. Be Mindful Of: Be Mindful Of: Token Hijacking: Implement short token lifetimes and enforce HTTPS.


Performance: Tokens should be validated in RAM (e.g. validating in Redis’ token cache). Token Hijacking: Implement short token lifetimes and enforce HTTPS. Token Hijacking: Implement short token lifetimes and enforce HTTPS. Performance: Tokens should be validated in RAM (e.g. validating in Redis’ token cache). Performance: Tokens should be validated in RAM (e.g. validating in Redis’ token cache). Challenge Yourself: “Do I have to hit the auth service for every request, or is there a way to cache the auth results?" Challenge Yourself: API Gateway Tools: An Editing Guide for Developers API Gateway Tools: An Editing Guide for Developers Kong. The Swiss Army Knife. Best for: Customizability. You need a Kafka pluging? Get it here. Example: A startup uses Kong to implement OAuth2, rate limiting, and logging features without any coding. Watch out: What about scaling and security if you have to maintain your own Kong nodes?


Istio: The Kubernetes Maestro Best for: Employees of already existing Kubernetes ecosystems get the most out of this service mesh + API Gateway. This is literally the best. A chef's kisss. Example: Splitting incoming traffic between v1 and v2 of a service is a great way to speed up A/B testing. Watch out: This is out of the question if you not entirely into Kubernetes.


NGINX: The Reliable Workhorse Best for: Easiest to use for people who want great results without too much hassle. Example: Iterating on an existing chai tea microservices application where the NGINX does reverse proxying. Watch out: Better get an Ansible or Terraform because those configuration files will rot away without clean up automation.


AWS API Gateway: The Serverless Sidekick Best for: Kong helps Serverless stacks with example application implementations. (Lambda + API Gateway = ❤️ ). Example: Serverless backend for an ecommerce project that uses auto-scaling. Watch out: You really need to carefully monitor usage or else, boom, cost explosion. Kong. The Swiss Army Knife. Best for: Customizability. You need a Kafka pluging? Get it here. Example: A startup uses Kong to implement OAuth2, rate limiting, and logging features without any coding. Watch out: What about scaling and security if you have to maintain your own Kong nodes? Kong. The Swiss Army Knife. Best for: Customizability. You need a Kafka pluging? Get it here. Example: A startup uses Kong to implement OAuth2, rate limiting, and logging features without any coding. Watch out: What about scaling and security if you have to maintain your own Kong nodes? Kong Istio: The Kubernetes Maestro Best for: Employees of already existing Kubernetes ecosystems get the most out of this service mesh + API Gateway. This is literally the best. A chef's kisss. Example: Splitting incoming traffic between v1 and v2 of a service is a great way to speed up A/B testing. Watch out: This is out of the question if you not entirely into Kubernetes. Istio: The Kubernetes Maestro Best for: Employees of already existing Kubernetes ecosystems get the most out of this service mesh + API Gateway. This is literally the best. A chef's kisss. Example: Splitting incoming traffic between v1 and v2 of a service is a great way to speed up A/B testing. Watch out: This is out of the question if you not entirely into Kubernetes. Istio NGINX: The Reliable Workhorse Best for: Easiest to use for people who want great results without too much hassle. Example: Iterating on an existing chai tea microservices application where the NGINX does reverse proxying. Watch out: Better get an Ansible or Terraform because those configuration files will rot away without clean up automation. NGINX: The Reliable Workhorse Best for: Easiest to use for people who want great results without too much hassle. Example: Iterating on an existing chai tea microservices application where the NGINX does reverse proxying. Watch out: Better get an Ansible or Terraform because those configuration files will rot away without clean up automation. NGINX AWS API Gateway: The Serverless Sidekick Best for: Kong helps Serverless stacks with example application implementations. (Lambda + API Gateway = ❤️ ). Example: Serverless backend for an ecommerce project that uses auto-scaling. Watch out: You really need to carefully monitor usage or else, boom, cost explosion. AWS API Gateway: The Serverless Sidekick Best for: Kong helps Serverless stacks with example application implementations. (Lambda + API Gateway = ❤️ ). Example: Serverless backend for an ecommerce project that uses auto-scaling. Watch out: You really need to carefully monitor usage or else, boom, cost explosion. AWS API Gateway: The Dark Side of API Gateways: Avoid these pitfalls The Dark Side of API Gateways: Avoid these pitfalls Over–Engineering The Sin: Implementing a service mesh for a 3-service app is wasted.
The Solution: Begin with the basics. Use NGINX or a managed gateway and increase the complexity based on your requirements. Over–Engineering The Sin: Implementing a service mesh for a 3-service app is wasted.
The Solution: Begin with the basics. Use NGINX or a managed gateway and increase the complexity based on your requirements. Over–Engineering The Sin: Implementing a service mesh for a 3-service app is wasted. Over–Engineering The Sin: Implementing a service mesh for a 3-service app is wasted. The Solution: Begin with the basics. Use NGINX or a managed gateway and increase the complexity based on your requirements. Not Accounting Observability The Sin: Absence of measurements on lag, faults, and rate limiting.
The Fix: Implemented Grafana + Prometheus for monitoring: Rates of 4xx/5xx responses Average response time Rate limit requests


Vendor Lock In The Sin: Over Arching everything around the AWS API Gateway, then needing to change it becomes extremely expensive.
The Fix: Use a Serverless Framework or Terraform to abstract the gateway logic. Not Accounting Observability The Sin: Absence of measurements on lag, faults, and rate limiting.
The Fix: Implemented Grafana + Prometheus for monitoring: Rates of 4xx/5xx responses Average response time Rate limit requests Not Accounting Observability The Sin: Absence of measurements on lag, faults, and rate limiting. Not Accounting Observability The Sin: The Fix: Implemented Grafana + Prometheus for monitoring: Rates of 4xx/5xx responses Average response time Rate limit requests Vendor Lock In The Sin: Over Arching everything around the AWS API Gateway, then needing to change it becomes extremely expensive.
The Fix: Use a Serverless Framework or Terraform to abstract the gateway logic. Vendor Lock In The Sin: Over Arching everything around the AWS API Gateway, then needing to change it becomes extremely expensive. Vendor Lock In The Sin: The Fix: Use a Serverless Framework or Terraform to abstract the gateway logic. FAQ: Your Most Pressing Questions, Addressed FAQ: Your Most Pressing Questions, Addressed Q: When should I implement a Backends For Frontends (BFF) compared to one single Gateway? A: Implement BFFs if your clients web and mobile, or any external client require exceptionally different information otherwise it is best kept simple. Q: Can I deploy several API gateways? A: Absolutely! Internal services can utilize Kong while external services can use AWS API Gateway. Just be cautious of complexity. Q: What if the gateway fails? A: Gateways should be deployed in a cluster with load balancing; have circuit breakers in place, such as Hystrix, to fail softly. Q: Can I use an API gateway in place of a Service Mesh? A: Certainly not! A gateway manages traffic from north to south (from the client to the service) while a mesh handles east-west traffic (from one service to another). Final Thoughts: Your Gateway To Greatness Final Thoughts: Your Gateway To Greatness API gateways, are not some magic tool, they are something you create and control. Just like any other tool they need to be utilized to their full potential in order to see desired outcomes. Prior to Beginning Construction: Identify Your Requirements: Evaluate whether you require authentication, rate limiting, or protocol translation assistance.


Get Familiar With The Tools: Launch Kong and AWS API Gateway in a sandbox. Which of the two is more suitable?


Plan for Future Growth: Will your gateway be capable of accommodating 10 times the traffic next year? Identify Your Requirements: Evaluate whether you require authentication, rate limiting, or protocol translation assistance. Identify Your Requirements: Evaluate whether you require authentication, rate limiting, or protocol translation assistance. Get Familiar With The Tools: Launch Kong and AWS API Gateway in a sandbox. Which of the two is more suitable? Get Familiar With The Tools: Launch Kong and AWS API Gateway in a sandbox. Which of the two is more suitable? Plan for Future Growth: Will your gateway be capable of accommodating 10 times the traffic next year? Plan for Future Growth: Will your gateway be capable of accommodating 10 times the traffic next year? It is critical to note that the goal is not to construct the ultimate gateway; instead, it is to address present issues while avoiding hindering future solutions. Now, go untangle that microservices spaghetti. 🍝

You Split Up Your Monolith—Now API Gateways Are Here to Save Your Butt

For aspiring game developers, breaking into the AAA gaming industry has long been a formidable challenge. Traditionally, high-budget studios with vast teams and years of experience have dominated the landscape, leaving small teams and solo developers struggling to gain a foothold. However, Epic Games has provided an unprecedented opportunity with the Unreal Editor for Fortnite (UEFN)—a powerful game development tool that enables newcomers to create and publish professional-quality experiences within Fortnite’s ecosystem. Unreal Editor for Fortnite (UEFN) This article explores how UEFN serves as a launchpad for new game developers, offering cutting-edge tools, a built-in player base, monetization opportunities, and a direct pathway to AAA game development. launchpad for new game developers What Is UEFN? What Is UEFN? UEFN is a specialized version of Unreal Engine 5, designed for Fortnite’s creative ecosystem. Unlike Fortnite’s original Creative Mode, which offers a more limited set of tools, UEFN provides access to powerful industry-standard features such as Nanite, Lumen, custom asset imports, terrain editing, and the new scripting language, Verse. These capabilities allow developers to craft AAA-quality levels, mechanics, and even entirely new game modes within Fortnite. specialized version of Unreal Engine 5 Nanite, Lumen, custom asset imports, terrain editing, and the new scripting language, Verse AAA-quality levels, mechanics, and even entirely new game modes Why UEFN Is a Perfect Gateway to AAA Gaming Why UEFN Is a Perfect Gateway to AAA Gaming 1. Hands-On Experience with AAA Tools (For Free) 1. Hands-On Experience with AAA Tools (For Free) UEFN grants developers access to the same technology used by major studios—without any upfront cost. Features like real-time global illumination, high-resolution asset rendering, and full physics-based environments enable small teams to learn and master AAA-grade development tools within a sandboxed environment. learn and master AAA-grade development tools For newcomers, UEFN provides a low-barrier entry point into the Unreal Engine ecosystem, allowing them to build a portfolio of real-world projects that demonstrate proficiency with UE5 workflows, optimization techniques, and multiplayer networking—all skills highly valued in the AAA industry. real-world projects UE5 workflows, optimization techniques, and multiplayer networking 2. Monetization Through Creator Economy 2.0 2. Monetization Through Creator Economy 2.0 One of the biggest hurdles for indie developers is financial sustainability. UEFN’s Creator Economy 2.0 program provides a built-in monetization model, where developers earn revenue based on player engagement. Unlike traditional indie games that require marketing and distribution efforts, UEFN allows creators to tap into Fortnite’s massive player base, offering immediate exposure and a chance to earn while they build. Creator Economy 2.0 massive player base By publishing experiences within Fortnite, developers can generate income that funds future projects or serves as proof of concept when pitching to publishers and investors. 3. Industry Recognition and Career Opportunities 3. Industry Recognition and Career Opportunities Successful UEFN developers have the opportunity to gain visibility within the gaming industry. Epic Games actively supports and spotlights high-quality UEFN projects, providing a direct line to AAA studios looking for fresh talent. By showcasing polished work within Fortnite, developers can attract job offers, collaborations, or even investment in their own independent studios. high-quality UEFN projects AAA studios looking for fresh talent In addition, many game studios are now recruiting directly from the UEFN creator pool, recognizing it as a proving ground for game design, level creation, and scripting expertise. recruiting directly from the UEFN creator pool game design, level creation, and scripting expertise 4. A Built-In Player Base for Testing and Iteration 4. A Built-In Player Base for Testing and Iteration One of the most significant challenges for indie developers is gaining players. In traditional game development, launching a game requires significant marketing efforts, which often prove to be costly and time-consuming. With UEFN, developers can skip this hurdle by instantly deploying their games to Fortnite’s millions of active users. skip this hurdle millions of active users This built-in audience allows developers to receive immediate feedback, refine their designs based on real-world data, and improve their skills in a live environment—mirroring the iterative process used in AAA game development. immediate feedback 5. Low-Risk Prototyping for Future Indie or AAA Projects 5. Low-Risk Prototyping for Future Indie or AAA Projects UEFN serves as an excellent low-risk testing ground for new ideas. Developers can prototype mechanics, experiment with game design principles, and polish their skills without investing in expensive software or distribution platforms. low-risk testing ground without investing in expensive software or distribution platforms For indie developers who eventually want to release standalone games, UEFN offers a risk-free way to validate ideas before committing to full-scale production. Many mechanics and concepts can be tested within Fortnite before being ported to a standalone Unreal Engine 5 project. risk-free way to validate ideas 6. Learning the Future of Game Scripting with Verse 6. Learning the Future of Game Scripting with Verse UEFN introduces Verse, a new scripting language designed specifically for Fortnite’s ecosystem but with broader implications for future game development. By learning Verse, developers gain a head start on a cutting-edge scripting language that may become a significant part of Unreal Engine’s future. Verse head start on a cutting-edge scripting language Verse allows for advanced game logic, dynamic environments, and customized gameplay experiences, providing skills that translate directly to AAA game development and live-service game operations. advanced game logic, dynamic environments, and customized gameplay experiences AAA game development and live-service game operations How to Get Started with UEFN How to Get Started with UEFN For those looking to jump into UEFN, here’s a step-by-step roadmap: Download UEFN – Available for free through the Epic Games Launcher.


Explore Tutorials and Documentation – Epic provides extensive guides, YouTube tutorials, and community forums to help newcomers get started.


Join the UEFN Creator Community – Engage with other developers, participate in Epic-hosted game jams, and learn from industry experts.


Start Small and Iterate – Build simple experiences first, then gradually increase complexity as you gain confidence.


Monetize and Showcase Your Work – Once comfortable, start publishing experiences and applying for Creator Economy 2.0. Download UEFN – Available for free through the Epic Games Launcher. Download UEFN – Available for free through the Epic Games Launcher. Download UEFN Epic Games Launcher Explore Tutorials and Documentation – Epic provides extensive guides, YouTube tutorials, and community forums to help newcomers get started. Explore Tutorials and Documentation – Epic provides extensive guides, YouTube tutorials, and community forums to help newcomers get started. Explore Tutorials and Documentation Join the UEFN Creator Community – Engage with other developers, participate in Epic-hosted game jams, and learn from industry experts. Join the UEFN Creator Community – Engage with other developers, participate in Epic-hosted game jams, and learn from industry experts. Join the UEFN Creator Community Start Small and Iterate – Build simple experiences first, then gradually increase complexity as you gain confidence. Start Small and Iterate – Build simple experiences first, then gradually increase complexity as you gain confidence. Start Small and Iterate Monetize and Showcase Your Work – Once comfortable, start publishing experiences and applying for Creator Economy 2.0. Monetize and Showcase Your Work – Once comfortable, start publishing experiences and applying for Creator Economy 2.0. Monetize and Showcase Your Work Creator Economy 2.0 Unreal Editor for Fortnite is more than just a tool for creating custom Fortnite experiences—it’s a gateway to the world of AAA game development. By leveraging its powerful features, built-in monetization, and direct exposure to millions of players, developers can hone their craft, generate income, and open doors to professional opportunities that were once out of reach. gateway to the world of AAA game development hone their craft, generate income, and open doors to professional opportunities For indie developers, students, and aspiring game designers, UEFN represents a golden opportunity to break into the industry—all while building games in one of the world’s most popular platforms. Whether your goal is to work at a major studio or launch your own indie game, UEFN is a proven pathway to success in modern game development. golden opportunity to break into the industry proven pathway to success in modern game development

Unreal Editor for Fortnite: A Game-Changing Gateway to AAA Development

Unreal Editor para Fortnite: Una puerta de entrada cambiante para el desarrollo AAA

ویرایشگر Unreal Fortnite: A Game-Changing Gateway to AAA Development

Unreal Editor for Fortnite: A Game-Changing Gateway to AAA Development(Fortnite:ゲームを変えるゲートウェイ)

Unreal Editor ho an'ny Fortnite: A Game-Changing Gateway ho an'ny fampandrosoana AAA

Fortnite-ийн Unreal Editor: A Game-Changing Gateway нь AAA хөгжүүлэх

Unreal Editor untuk Fortnite: Gateway Perubahan Permainan kepada Pembangunan AAA

Unreal Editor for Fortnite: A Game-Changing Gateway to AAA Development සඳහා ක්රීඩාව වෙනස් කිරීම

ERROR: invalid target_lang (sn)

Unreal Editor për Fortnite: Një portë që ndryshon lojën për zhvillimin AAA

Mhariri asiye halisi wa Fortnite: Lango la Kubadilisha Mchezo kwa Ukuzaji wa AAA

Umhleli Ongeyena Wangempela we-Fortnite: Isango Elishintsha Igeyimu Ekuthuthukisweni kwe-AAA

Veera, a rapidly growing internet browser, is now available in over 100 countries, delivering a seamless browsing experience alongside one of the most comprehensive Web3 ecosystems. With over 4 million users and a monthly active base of 1 million+, Veera is positioning itself at the forefront of the evolving decentralized internet. Built for the future of the internet, Veera is designed to make Web3 intuitive, accessible, and rewarding. By combining decentralized applications (dApps), digital wallets, tokenized rewards, and secure browsing into a single interface, Veera eliminates the complexity that has historically hindered Web3 adoption. Since its launch, Veera has scaled 4mn users in less than a year, with a monthly active user base of 1Mn+, a daily active user base of 100k+, and an average time spent of over 13mins per day. With web3 usage growing every single day, Veera is set to be a game-changer in this fast-evolving ecosystem. "We are super excited to take Veera to over 100 markets within the first year of launch. I’m super grateful to the team, our investors, and our user base for giving us this confidence. Our goal with Veera was to build a product that genuinely adds value to users’ lives. We have always been a gateway to the internet for our users—now, we’re also a comprehensive gateway to the world of Web3. We believe the future of the internet is decentralized, and Veera is designed to make that future accessible to everyone. We are conscious of the responsibility we have to provide the best possible experience to new users exploring web3 for the first time. And this is just the beginning. We have so much more in store for users across the world," said Arjun Ghose, Founder & CEO, Veera. “Veera isn’t just a browser; it’s a gateway to the decentralized world because it packs the power of a browser, crypto wallet, dapp store and immersive Web3 experiences into a single platform. Our mission is simple: empower users with a secure, privacy-focused, and rewarding Web3 experience. Our intuitive UX simplifies access to Web3 onboarding while preserving user autonomy, helping us shape the next era of the internet,” added Sukhdeep Bhogal, COO & CPO, Veera. Veera was envisioned as a Web3-native challenger browser by Arjun Ghose (former investor at Falcon Edge/Alpha Wave and McKinsey), Aditya Julka (serial entrepreneur, Founder of Paddle8, and entrepreneur-in-residence at Harvard Business School), and Kanu Gupta (founding leadership of Goldman Sachs in India, serial investor). Backed by leading investors including CMCC, 6th Man Ventures, Folius Ventures, Reflexive Ventures, Sfermion, Ayon Capital, COG Network, and iSeed Ventures, Veera is shaping the future of decentralized browsing and digital experiences. The company’s roadmap includes an upcoming iOS launch, further chain abstraction & support, referrals, single click swaps, etc., further strengthening Veera’s position as the definitive Web3 SuperApp for users worldwide. Website: https://veera.com/ Product Video - https://youtu.be/VAtEevBYuHc Veera, a rapidly growing internet browser, is now available in over 100 countries, delivering a seamless browsing experience alongside one of the most comprehensive Web3 ecosystems. With over 4 million users and a monthly active base of 1 million+, Veera is positioning itself at the forefront of the evolving decentralized internet. Built for the future of the internet, Veera is designed to make Web3 intuitive, accessible, and rewarding. By combining decentralized applications (dApps), digital wallets, tokenized rewards, and secure browsing into a single interface, Veera eliminates the complexity that has historically hindered Web3 adoption. Since its launch, Veera has scaled 4mn users in less than a year, with a monthly active user base of 1Mn+, a daily active user base of 100k+, and an average time spent of over 13mins per day. With web3 usage growing every single day, Veera is set to be a game-changer in this fast-evolving ecosystem. "We are super excited to take Veera to over 100 markets within the first year of launch. I’m super grateful to the team, our investors, and our user base for giving us this confidence. Our goal with Veera was to build a product that genuinely adds value to users’ lives. We have always been a gateway to the internet for our users—now, we’re also a comprehensive gateway to the world of Web3. We believe the future of the internet is decentralized, and Veera is designed to make that future accessible to everyone. We are conscious of the responsibility we have to provide the best possible experience to new users exploring web3 for the first time. And this is just the beginning. We have so much more in store for users across the world," said Arjun Ghose, Founder & CEO, Veera. “Veera isn’t just a browser; it’s a gateway to the decentralized world because it packs the power of a browser, crypto wallet, dapp store and immersive Web3 experiences into a single platform. Our mission is simple: empower users with a secure, privacy-focused, and rewarding Web3 experience. Our intuitive UX simplifies access to Web3 onboarding while preserving user autonomy, helping us shape the next era of the internet,” added Sukhdeep Bhogal, COO & CPO, Veera. Veera was envisioned as a Web3-native challenger browser by Arjun Ghose (former investor at Falcon Edge/Alpha Wave and McKinsey), Aditya Julka (serial entrepreneur, Founder of Paddle8, and entrepreneur-in-residence at Harvard Business School), and Kanu Gupta (founding leadership of Goldman Sachs in India, serial investor). Backed by leading investors including CMCC, 6th Man Ventures, Folius Ventures, Reflexive Ventures, Sfermion, Ayon Capital, COG Network, and iSeed Ventures, Veera is shaping the future of decentralized browsing and digital experiences. The company’s roadmap includes an upcoming iOS launch, further chain abstraction & support, referrals, single click swaps, etc., further strengthening Veera’s position as the definitive Web3 SuperApp for users worldwide. Website: https://veera.com/ https://veera.com/ Product Video - https://youtu.be/VAtEevBYuHc https://youtu.be/VAtEevBYuHc

100+ Markets and Counting - Veera Becomes the Ultimate Gateway to Web3

100+ Markanaka ukat Jakhuwi - Veera ukax Web3 ukar Qhipa Punkuruw tuku

100+ tržišta i brojanje - Veera postaje ultimativni pristup Web3

100+ markeder og tæller - Veera bliver den ultimative gateway til Web3

100+ αγορές και καταμέτρηση - Η Veera γίνεται η απόλυτη πύλη στο Web3

Más de 100 mercados y seguimos sumando: Veera se convierte en la puerta de entrada definitiva a la Web3

100+ Merkatu eta zenbatzen - Veera Web3rako azken ataria bihurtzen da

100+ piac és számlálás – Veera a Web3 végső kapuja

100+ շուկաներ և հաշվում – Veera-ն դառնում է Web3-ի վերջնական դարպասը

100以上の市場とカウント - VeeraはWeb3への究極のゲートウェイになります

100+ бозорҳо ва ҳисобкунӣ - Veera дарвозаи ниҳоии Web3 мегардад

100+ Markets at Nagbibilang - Naging Ultimate Gateway sa Web3 si Veera

100+ ринків і їх кількість зростає - Veera стає найкращим шлюзом для Web3

Mark Your Calendars: February 14, 2025 We’re thrilled to announce that TapSwap, the world’s first Web3 skill-gaming platform, is taking a giant leap forward with its listing on Bitget on February 14, 2025. This milestone marks an exciting new chapter in our journey, reinforcing our commitment to building a sustainable and rewarding gaming ecosystem for millions of players worldwide. TapSwap: Where Skill Meets Crypto Unlike traditional play-to-earn models that rely on luck or monotonous grinding, TapSwap is all about skill-based gaming. Players are rewarded for their mastery and competitive edge rather than chance, creating a truly meritocratic environment where skill determines success. With a transparent blockchain-powered system, we ensure fair play, real earning opportunities, and a thriving economy centred around our native TAPS token. With over 72 million total users, 3 million daily active users (DAU), and 10 million weekly active users (WAU), TapSwap has quickly grown into one of the most active Web3 gaming communities. Whether you're a casual gamer or an esports competitor, TapSwap offers a platform where you can compete, earn, and engage in a decentralized gaming experience like never before. The Power of the TAPS Token At the core of TapSwap’s ecosystem is the TAPS token, designed to power the platform’s economy and provide multiple avenues for user engagement, including: Tournament Participation: Enter skill-based tournaments with TAPS and compete for substantial rewards.
Fight2Earn: A high-stakes mode where players battle for TAPS rewards based purely on skill.
Staking & Passive Income: Users can stake TAPS to earn rewards while contributing to the ecosystem’s stability.
Governance: Token holders influence platform decisions, shaping the future of TapSwap.
In-Game Purchases & Premium Access: Enhance your gaming experience with exclusive skins, avatars, and premium accounts. Why the Bitget Listing Matters Our listing on Bitget, a leading cryptocurrency exchange, is a major step toward long-term success for TapSwap and its growing community. This listing: Boosts TAPS liquidity and accessibility
Opens doors for new investors and gamers
Strengthens TapSwap’s position in the Web3 gaming market
Creates more opportunities for the TapSwap community to grow and thrive By listing on Bitget, we’re not just increasing the reach of the TAPS token—we’re creating a gateway for millions of users to join the TapSwap movement and benefit from a truly skill-based gaming economy. GATE OPPORTUNITY: Don’t Miss Out With the Bitget listing right around the corner, now is the perfect time to get involved in TapSwap’s ecosystem. Whether you’re a gamer, investor, or blockchain enthusiast, this is your chance to be part of a revolutionary Web3 gaming platform. 🚨 BIG NEWS FOR THE TAPSWAP COMMUNITY! 🚨 All TapSwap community members have just received 10 tickets in the TapSwap mini-app! 🎟️ These tickets are your FREE entry to the BIG GAME happening at the launch of our Web3 skill gaming platform! 🕹️🔥 🏆 $1 MILLION PRIZE POOL—for the winners of this epic competition! 💰💎 Didn’t participate in the TapSwap app? No worries—you’ll still have the chance to buy tickets and join the game! The future of skill-based gaming is here, and we’re just getting started. TapSwap is one of the first tap-to-earn projects that is transforming into a full-fledged gaming platform. Invest, play, and win with TapSwap! Read the full details about our Bitget listing and how you can participate in the $1M prize pool! This story was distributed as a release by Btcwire under HackerNoon’s Business Blogging Program. Learn more about the program here Mark Your Calendars: February 14, 2025 We’re thrilled to announce that TapSwap, the world’s first Web3 skill-gaming platform, is taking a giant leap forward with its listing on Bitget on February 14, 2025. This milestone marks an exciting new chapter in our journey, reinforcing our commitment to building a sustainable and rewarding gaming ecosystem for millions of players worldwide. TapSwap: Where Skill Meets Crypto Unlike traditional play-to-earn models that rely on luck or monotonous grinding, TapSwap is all about skill-based gaming . Players are rewarded for their mastery and competitive edge rather than chance, creating a truly meritocratic environment where skill determines success. skill-based gaming skill-based gaming With a transparent blockchain-powered system, we ensure fair play, real earning opportunities, and a thriving economy centred around our native TAPS token. With over 72 million total users, 3 million daily active users (DAU), and 10 million weekly active users (WAU), TapSwap has quickly grown into one of the most active Web3 gaming communities. Whether you're a casual gamer or an esports competitor, TapSwap offers a platform where you can compete, earn, and engage in a decentralized gaming experience like never before. The Power of the TAPS Token At the core of TapSwap’s ecosystem is the TAPS token, designed to power the platform’s economy and provide multiple avenues for user engagement, including: Tournament Participation: Enter skill-based tournaments with TAPS and compete for substantial rewards. Fight2Earn: A high-stakes mode where players battle for TAPS rewards based purely on skill. Staking & Passive Income: Users can stake TAPS to earn rewards while contributing to the ecosystem’s stability. Governance: Token holders influence platform decisions, shaping the future of TapSwap. In-Game Purchases & Premium Access: Enhance your gaming experience with exclusive skins, avatars, and premium accounts. Tournament Participation: Enter skill-based tournaments with TAPS and compete for substantial rewards. Fight2Earn: A high-stakes mode where players battle for TAPS rewards based purely on skill. Staking & Passive Income: Users can stake TAPS to earn rewards while contributing to the ecosystem’s stability. Governance: Token holders influence platform decisions, shaping the future of TapSwap. In-Game Purchases & Premium Access: Enhance your gaming experience with exclusive skins, avatars, and premium accounts. Why the Bitget Listing Matters Our listing on Bitget, a leading cryptocurrency exchange, is a major step toward long-term success for TapSwap and its growing community. This listing: Boosts TAPS liquidity and accessibility Opens doors for new investors and gamers Strengthens TapSwap’s position in the Web3 gaming market Creates more opportunities for the TapSwap community to grow and thrive Boosts TAPS liquidity and accessibility Opens doors for new investors and gamers Strengthens TapSwap’s position in the Web3 gaming market Creates more opportunities for the TapSwap community to grow and thrive By listing on Bitget, we’re not just increasing the reach of the TAPS token—we’re creating a gateway for millions of users to join the TapSwap movement and benefit from a truly skill-based gaming economy. GATE OPPORTUNITY: Don’t Miss Out With the Bitget listing right around the corner, now is the perfect time to get involved in TapSwap’s ecosystem. Whether you’re a gamer, investor, or blockchain enthusiast, this is your chance to be part of a revolutionary Web3 gaming platform. 🚨 BIG NEWS FOR THE TAPSWAP COMMUNITY! 🚨 All TapSwap community members have just received 10 tickets in the TapSwap mini-app! 🎟️ These tickets are your FREE entry to the BIG GAME happening at the launch of our Web3 skill gaming platform! 🕹️🔥 🏆 $1 MILLION PRIZE POOL—for the winners of this epic competition! 💰💎 Didn’t participate in the TapSwap app? No worries—you’ll still have the chance to buy tickets and join the game! The future of skill-based gaming is here, and we’re just getting started. TapSwap is one of the first tap-to-earn projects that is transforming into a full-fledged gaming platform. Invest, play, and win with TapSwap! Read the full details about our Bitget listing and how you can participate in the $1M prize pool! participate in the $1M prize pool! participate in the $1M prize pool! This story was distributed as a release by Btcwire under HackerNoon’s Business Blogging Program. Learn more about the program here This story was distributed as a release by Btcwire under HackerNoon’s Business Blogging Program. Learn more about the program here here here

TapSwap To Be Listed On Bitget: A Gateway To Long-Term Success

TikSwap om op Bitget gelys te word: 'n Poort na langtermynsukses

TapSwap být uveden na Bitget: Brána k dlouhodobému úspěchu

TapSwap για να εισαχθεί στο Bitget: Μια πύλη για τη μακροπρόθεσμη επιτυχία

TapSwap se incorporará a Bitget: una puerta de entrada al éxito a largo plazo

TapSwap כדי להירשם ב-Bitget: שער להצלחה ארוכת טווח

TapSwap će biti uvršten na Bitget: Put do dugoročnog uspjeha

TapSwap Akan Terdaftar di Bitget: Gerbang Menuju Kesuksesan Jangka Panjang

TapSwap が Bitget に上場: 長期的な成功への入り口

TapSwap за да биде наведен на Bitget: Порта за долгорочен успех

TapSwap будет добавлен на Bitget: путь к долгосрочному успеху

TapSwap byť uvedený na Bitget: Brána k dlhodobému úspechu

ТапСвап ће бити уврштен на Битгет: капија за дугорочни успех

A Strange Yucca Tribute Concert: Configuring Kong API Gateway With Micronaut Services in Kotlin 

A Single Point of Access or Chaos — Unlocking Non-Blocking API Gateways

When browsing the web, you may occasionally encounter an error message that reads, "504 Gateway Timeout." While it might seem cryptic at first, this error is more common than you think. If you're wondering what it is, why it happens, and how to fix it, this guide has got you covered. What Is a 504 Gateway Timeout Error? A 504 Gateway Timeout Error occurs when a server acting as a gateway or proxy doesn't receive a timely response from an upstream server. In simpler terms, it means the server you're trying to access is taking too long to respond. This error is a part of the HTTP status code family, which communicates the state of your connection to a server. A "504" indicates that the server acting as an intermediary (like a web host or content delivery network) could not complete your request because the upstream server is unresponsive. What Causes a 504 Gateway Timeout Error? Understanding the causes of this error is key to troubleshooting. Here are the most common reasons: 1. Server Overload The upstream server is overwhelmed with traffic or resource demands. Websites experiencing sudden surges in visitors (e.g., during sales or viral events) often encounter this issue. 2. Poor Server Communication The gateway server and upstream server fail to communicate properly due to misconfigured settings or network interruptions. 3. DNS Issues If DNS (Domain Name System) records are outdated or misconfigured, servers might fail to locate each other. 4. Firewall Restrictions Firewalls may block requests from a specific IP address, thinking it's malicious, causing communication breakdowns. 5. Server Timeout Settings If the timeout period for a server request is too short, slower upstream servers may not respond in time, triggering a 504 error. How to Fix a 504 Gateway Timeout Error Fixing this error depends on whether you're a website visitor or the owner of the website. For Website Visitors: Refresh the Page


Sometimes, a temporary issue on the server resolves itself. Refreshing can help.



Check Your Internet Connection


Ensure your connection is stable. Disconnect and reconnect to verify.



Try Another Browser or Device


Use a different browser or device to rule out local issues.



Clear Your Browser Cache


Cached files can sometimes cause errors. Clear your cache and cookies.



Check if the Website Is Down

Use a tool like CheckIfWebsiteDown to confirm if the issue is global. For Website Owners or Administrators: Check Server Logs


Analyze server logs to identify where the communication breakdown occurred.



Restart Your Servers


Restarting the gateway or upstream server may resolve temporary glitches.



Update DNS Records


Ensure your DNS records are updated and correctly configured.



Increase Timeout Limits


Extend timeout periods in your server settings to allow upstream servers more time to respond.



Optimize Server Performance


Use load balancers or upgrade your hosting plan to handle more traffic efficiently.



Disable Firewall or Proxy Blocks


Review firewall rules to ensure legitimate requests aren’t being blocked.



Contact Your Hosting Provider

If the issue persists, reach out to your hosting provider for support. Preventing 504 Gateway Timeout Errors Proactive measures can help prevent future occurrences. Here’s what you can do: Monitor Server Health: Regularly check your servers for high resource usage or connectivity issues.
Use a Content Delivery Network (CDN): CDNs can distribute traffic and reduce server strain.
Optimize Your Website: Minimize heavy scripts and ensure faster loading times.
Conduct Regular DNS Checks: Keep DNS records updated and resolve any configuration errors promptly. Common Variations of the 504 Error Depending on the browser or server, the error message might look different: "HTTP 504 Gateway Timeout"
"504 Error – The server didn't respond in time"
"504 Gateway Timeout – nginx"
"Gateway Timeout Error – Cloudflare" While the phrasing varies, the issue remains the same: delayed communication between servers. When Should You Seek Professional Help? If you've tried the above fixes and still experience the error frequently, it’s time to consult a professional. Persistent 504 errors could indicate underlying server misconfigurations or hardware issues requiring expert attention. For website visitors, if the error persists on multiple devices and browsers, contact the website owner or administrator. Key Takeaways A 504 Gateway Timeout Error occurs when servers fail to communicate within a set timeframe.
Causes range from server overload to DNS misconfigurations.
Fixes include refreshing the page, checking DNS settings, and optimizing server performance.
Regular monitoring and proactive measures can prevent these errors from happening frequently. The 504 Gateway Timeout Error may seem daunting, but with a clear understanding and the right troubleshooting steps, you can resolve it efficiently. Whether you're a visitor encountering the error or a website owner managing traffic, this guide equips you with actionable solutions to tackle the issue. When browsing the web, you may occasionally encounter an error message that reads, "504 Gateway Timeout." While it might seem cryptic at first, this error is more common than you think. If you're wondering what it is, why it happens, and how to fix it, this guide has got you covered. What Is a 504 Gateway Timeout Error? What Is a 504 Gateway Timeout Error? A 504 Gateway Timeout Error occurs when a server acting as a gateway or proxy doesn't receive a timely response from an upstream server. In simpler terms, it means the server you're trying to access is taking too long to respond. This error is a part of the HTTP status code family, which communicates the state of your connection to a server. A "504" indicates that the server acting as an intermediary (like a web host or content delivery network) could not complete your request because the upstream server is unresponsive. What Causes a 504 Gateway Timeout Error? Understanding the causes of this error is key to troubleshooting. Here are the most common reasons: 1. Server Overload The upstream server is overwhelmed with traffic or resource demands. The upstream server is overwhelmed with traffic or resource demands. Websites experiencing sudden surges in visitors (e.g., during sales or viral events) often encounter this issue. Websites experiencing sudden surges in visitors (e.g., during sales or viral events) often encounter this issue. 2. Poor Server Communication The gateway server and upstream server fail to communicate properly due to misconfigured settings or network interruptions. The gateway server and upstream server fail to communicate properly due to misconfigured settings or network interruptions. 3. DNS Issues If DNS (Domain Name System) records are outdated or misconfigured, servers might fail to locate each other. If DNS (Domain Name System) records are outdated or misconfigured, servers might fail to locate each other. 4. Firewall Restrictions Firewalls may block requests from a specific IP address, thinking it's malicious, causing communication breakdowns. Firewalls may block requests from a specific IP address, thinking it's malicious, causing communication breakdowns. 5. Server Timeout Settings If the timeout period for a server request is too short, slower upstream servers may not respond in time, triggering a 504 error. Settings If the timeout period for a server request is too short, slower upstream servers may not respond in time, triggering a 504 error. How to Fix a 504 Gateway Timeout Error How to Fix a 504 Gateway Timeout Error Fixing this error depends on whether you're a website visitor or the owner of the website. For Website Visitors: For Website Visitors: Refresh the Page


Sometimes, a temporary issue on the server resolves itself. Refreshing can help. Check Your Internet Connection


Ensure your connection is stable. Disconnect and reconnect to verify. Try Another Browser or Device


Use a different browser or device to rule out local issues. Clear Your Browser Cache


Cached files can sometimes cause errors. Clear your cache and cookies. Check if the Website Is Down

Use a tool like CheckIfWebsiteDown to confirm if the issue is global. Refresh the Page Sometimes, a temporary issue on the server resolves itself. Refreshing can help. Refresh the Page Sometimes, a temporary issue on the server resolves itself. Refreshing can help. Sometimes, a temporary issue on the server resolves itself. Refreshing can help. Sometimes, a temporary issue on the server resolves itself. Refreshing can help. Check Your Internet Connection Ensure your connection is stable. Disconnect and reconnect to verify. Check Your Internet Connection Ensure your connection is stable. Disconnect and reconnect to verify. Ensure your connection is stable. Disconnect and reconnect to verify. Ensure your connection is stable. Disconnect and reconnect to verify. Try Another Browser or Device Use a different browser or device to rule out local issues. Try Another Browser or Device Use a different browser or device to rule out local issues. Use a different browser or device to rule out local issues. Use a different browser or device to rule out local issues. Clear Your Browser Cache Cached files can sometimes cause errors. Clear your cache and cookies. Clear Your Browser Cache Cached files can sometimes cause errors. Clear your cache and cookies. Cached files can sometimes cause errors. Clear your cache and cookies. Cached files can sometimes cause errors. Clear your cache and cookies. Check if the Website Is Down Use a tool like CheckIfWebsiteDown to confirm if the issue is global. Check if the Website Is Down Use a tool like CheckIfWebsiteDown to confirm if the issue is global. Use a tool like CheckIfWebsiteDown to confirm if the issue is global. CheckIfWebsiteDown For Website Owners or Administrators: For Website Owners or Administrators: Check Server Logs


Analyze server logs to identify where the communication breakdown occurred. Restart Your Servers


Restarting the gateway or upstream server may resolve temporary glitches. Update DNS Records


Ensure your DNS records are updated and correctly configured. Increase Timeout Limits


Extend timeout periods in your server settings to allow upstream servers more time to respond. Optimize Server Performance


Use load balancers or upgrade your hosting plan to handle more traffic efficiently. Disable Firewall or Proxy Blocks


Review firewall rules to ensure legitimate requests aren’t being blocked. Contact Your Hosting Provider

If the issue persists, reach out to your hosting provider for support. Check Server Logs Analyze server logs to identify where the communication breakdown occurred. Check Server Logs Analyze server logs to identify where the communication breakdown occurred. Analyze server logs to identify where the communication breakdown occurred. Analyze server logs to identify where the communication breakdown occurred. Restart Your Servers Restarting the gateway or upstream server may resolve temporary glitches. Restart Your Servers Restarting the gateway or upstream server may resolve temporary glitches. Restarting the gateway or upstream server may resolve temporary glitches. Restarting the gateway or upstream server may resolve temporary glitches. Update DNS Records Ensure your DNS records are updated and correctly configured. Update DNS Records Ensure your DNS records are updated and correctly configured. Ensure your DNS records are updated and correctly configured. Ensure your DNS records are updated and correctly configured. Increase Timeout Limits Extend timeout periods in your server settings to allow upstream servers more time to respond. Increase Timeout Limits Extend timeout periods in your server settings to allow upstream servers more time to respond. Extend timeout periods in your server settings to allow upstream servers more time to respond. Extend timeout periods in your server settings to allow upstream servers more time to respond. Optimize Server Performance Use load balancers or upgrade your hosting plan to handle more traffic efficiently. Optimize Server Performance Use load balancers or upgrade your hosting plan to handle more traffic efficiently. Use load balancers or upgrade your hosting plan to handle more traffic efficiently. Use load balancers or upgrade your hosting plan to handle more traffic efficiently. Disable Firewall or Proxy Blocks Review firewall rules to ensure legitimate requests aren’t being blocked. Disable Firewall or Proxy Blocks Review firewall rules to ensure legitimate requests aren’t being blocked. Review firewall rules to ensure legitimate requests aren’t being blocked. Review firewall rules to ensure legitimate requests aren’t being blocked. Contact Your Hosting Provider If the issue persists, reach out to your hosting provider for support. Contact Your Hosting Provider If the issue persists, reach out to your hosting provider for support. If the issue persists, reach out to your hosting provider for support. Preventing 504 Gateway Timeout Errors Preventing 504 Gateway Timeout Errors Proactive measures can help prevent future occurrences. Here’s what you can do: Monitor Server Health: Regularly check your servers for high resource usage or connectivity issues. Use a Content Delivery Network (CDN): CDNs can distribute traffic and reduce server strain. Optimize Your Website: Minimize heavy scripts and ensure faster loading times. Conduct Regular DNS Checks: Keep DNS records updated and resolve any configuration errors promptly. Monitor Server Health: Regularly check your servers for high resource usage or connectivity issues. Monitor Server Health: Use a Content Delivery Network (CDN): CDNs can distribute traffic and reduce server strain. Use a Content Delivery Network (CDN): Optimize Your Website: Minimize heavy scripts and ensure faster loading times. Optimize Your Website: Conduct Regular DNS Checks: Keep DNS records updated and resolve any configuration errors promptly. Conduct Regular DNS Checks: Common Variations of the 504 Error Common Variations of the 504 Error Depending on the browser or server, the error message might look different: "HTTP 504 Gateway Timeout" "504 Error – The server didn't respond in time" "504 Gateway Timeout – nginx" "Gateway Timeout Error – Cloudflare" "HTTP 504 Gateway Timeout" "HTTP 504 Gateway Timeout" "504 Error – The server didn't respond in time" "504 Error – The server didn't respond in time" "504 Gateway Timeout – nginx" "504 Gateway Timeout – nginx" "Gateway Timeout Error – Cloudflare" "Gateway Timeout Error – Cloudflare" While the phrasing varies, the issue remains the same: delayed communication between servers. When Should You Seek Professional Help? When Should You Seek Professional Help? If you've tried the above fixes and still experience the error frequently, it’s time to consult a professional. Persistent 504 errors could indicate underlying server misconfigurations or hardware issues requiring expert attention. For website visitors, if the error persists on multiple devices and browsers, contact the website owner or administrator. Key Takeaways Key Takeaways A 504 Gateway Timeout Error occurs when servers fail to communicate within a set timeframe. Causes range from server overload to DNS misconfigurations. Fixes include refreshing the page, checking DNS settings, and optimizing server performance. Regular monitoring and proactive measures can prevent these errors from happening frequently. A 504 Gateway Timeout Error occurs when servers fail to communicate within a set timeframe. Causes range from server overload to DNS misconfigurations. Fixes include refreshing the page, checking DNS settings, and optimizing server performance. Regular monitoring and proactive measures can prevent these errors from happening frequently. The 504 Gateway Timeout Error may seem daunting, but with a clear understanding and the right troubleshooting steps, you can resolve it efficiently. Whether you're a visitor encountering the error or a website owner managing traffic, this guide equips you with actionable solutions to tackle the issue.

What Is a 504 Gateway Timeout Error? Causes, Fixes, and Prevention

Kerberoasting: A Gateway to Privilege Escalation in Enterprise Networks

Cryptix.io, a trailblazer in cryptocurrency payment processing, announces its strategic expansion into the European market, poised to transform how businesses handle digital payments. Redefining Crypto Payment Standards With a proven track record of over three years in the industry, Cryptix has established itself as a trusted partner for online businesses globally. The company’s entry into Europe marks a significant milestone, offering advanced crypto payment solutions tailored to the needs of European enterprises. By seamlessly converting digital assets into fiat currencies or stablecoins, Cryptix is set to become a vital player in the region’s digital economy. A Global Vision with Local Benefits Cryptix’s expansion isn’t just about geographical growth; it’s about inclusivity and adaptability in the rapidly evolving world of digital finance. Alongside support for EUR and USD, Cryptix now accommodates MXN (Mexican Peso), BRL (Brazilian Real), and COP (Colombian Peso), reflecting its commitment to serving a diverse clientele. European businesses can now tap into broader markets with ease, leveraging Cryptix’s ability to facilitate transactions in multiple currencies. Streamlined Integration and User Experience What sets Cryptix apart is its focus on simplicity and efficiency. Businesses can integrate Cryptix into their operations via API or HTML iFrame, ensuring a smooth setup process. For those seeking a no-code solution, Cryptix offers an intuitive payment link generation feature, enabling swift transactions without the need for technical expertise. The comprehensive dashboard provided by Cryptix consolidates all essential functions into a single interface—managing conversions, top-ups, transaction histories, mass payouts, and withdrawals has never been easier. To combat the volatility inherent in cryptocurrency markets, Cryptix’s auto-conversion feature instantly converts crypto payments into stablecoins or fiat currencies, shielding businesses from exchange rate fluctuations**.** Unrivaled Value Proposition As Cryptix enters the European market, it does so with a clear value proposition: unparalleled transaction limits and minimal fees. Businesses can process up to $10,000 in transactions without requiring Know Your Business (KYB) verification. Upon verification, the sky's the limit—literally, with no upper cap on transaction volumes. Cryptix’s fee structure is another game-changer. With no charges for cryptocurrency top-ups or crypto-to-crypto exchanges, and a 0% fee for crypto-to-fiat conversions, the platform is among the most cost-effective in the industry. A modest 0.4% fee for accepting crypto payments and a 0.6% fee for fiat settlements further underscores Cryptix’s commitment to offering businesses a competitive edge in a burgeoning market. Positioning for the Future Cryptix’s European expansion signals more than just growth—it’s a bold statement of intent. As businesses across the continent grapple with the complexities of digital finance, Cryptix is set to provide them with the tools they need to thrive. By reducing barriers to entry and ensuring cost-effectiveness, Cryptix is not only entering the European market but is set to dominate it. For inquiries, please reach out at contact@cryptix.io About Cryptix.io Cryptix remains at the forefront of compliance, adhering strictly to Counterterrorism Financing (CTF) and Anti-Money Laundering (AML) regulations. Registered with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), Cryptix ensures the highest standards of safety and integrity in its operations. Committed to supporting small and medium-sized enterprises (SMEs), Cryptix empowers businesses to harness the potential of digital currencies, driving economic growth across regions. Cryptix.io, a trailblazer in cryptocurrency payment processing, announces its strategic expansion into the European market, poised to transform how businesses handle digital payments. Cryptix.io, a trailblazer in cryptocurrency payment processing, announces its strategic expansion into the European market, poised to transform how businesses handle digital payments. Cryptix.io, a trailblazer in cryptocurrency payment processing, announces its strategic expansion into the European market, poised to transform how businesses handle digital payments. Redefining Crypto Payment Standards Redefining Crypto Payment Standards With a proven track record of over three years in the industry, Cryptix has established itself as a trusted partner for online businesses globally. The company’s entry into Europe marks a significant milestone, offering advanced crypto payment solutions tailored to the needs of European enterprises. By seamlessly converting digital assets into fiat currencies or stablecoins, Cryptix is set to become a vital player in the region’s digital economy. A Global Vision with Local Benefits A Global Vision with Local Benefits Cryptix’s expansion isn’t just about geographical growth; it’s about inclusivity and adaptability in the rapidly evolving world of digital finance. Alongside support for EUR and USD, Cryptix now accommodates MXN (Mexican Peso), BRL (Brazilian Real), and COP (Colombian Peso), reflecting its commitment to serving a diverse clientele. European businesses can now tap into broader markets with ease, leveraging Cryptix’s ability to facilitate transactions in multiple currencies. Streamlined Integration and User Experience Streamlined Integration and User Experience What sets Cryptix apart is its focus on simplicity and efficiency. Businesses can integrate Cryptix into their operations via API or HTML iFrame, ensuring a smooth setup process. For those seeking a no-code solution, Cryptix offers an intuitive payment link generation feature, enabling swift transactions without the need for technical expertise. The comprehensive dashboard provided by Cryptix consolidates all essential functions into a single interface—managing conversions, top-ups, transaction histories, mass payouts, and withdrawals has never been easier. To combat the volatility inherent in cryptocurrency markets, Cryptix’s auto-conversion feature instantly converts crypto payments into stablecoins or fiat currencies, shielding businesses from exchange rate fluctuations**.** Unrivaled Value Proposition Unrivaled Value Proposition As Cryptix enters the European market, it does so with a clear value proposition: unparalleled transaction limits and minimal fees. Businesses can process up to $10,000 in transactions without requiring Know Your Business (KYB) verification. Upon verification, the sky's the limit—literally, with no upper cap on transaction volumes. Cryptix’s fee structure is another game-changer. With no charges for cryptocurrency top-ups or crypto-to-crypto exchanges, and a 0% fee for crypto-to-fiat conversions, the platform is among the most cost-effective in the industry. A modest 0.4% fee for accepting crypto payments and a 0.6% fee for fiat settlements further underscores Cryptix’s commitment to offering businesses a competitive edge in a burgeoning market. Positioning for the Future Positioning for the Future Cryptix’s European expansion signals more than just growth—it’s a bold statement of intent. As businesses across the continent grapple with the complexities of digital finance, Cryptix is set to provide them with the tools they need to thrive. By reducing barriers to entry and ensuring cost-effectiveness, Cryptix is not only entering the European market but is set to dominate it. For inquiries, please reach out at contact@cryptix.io For inquiries, please reach out at contact@cryptix.io contact@cryptix.io contact@cryptix.io About Cryptix.io About Cryptix.io Cryptix remains at the forefront of compliance, adhering strictly to Counterterrorism Financing (CTF) and Anti-Money Laundering (AML) regulations. Registered with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), Cryptix ensures the highest standards of safety and integrity in its operations. Committed to supporting small and medium-sized enterprises (SMEs), Cryptix empowers businesses to harness the potential of digital currencies, driving economic growth across regions. Cryptix Cryptix

Cryptix Revolutionizes Crypto Payments in Europe with Innovative Gateway Solutions

Cryptix ukax Europa uksanx Crypto Payllawinakx Revolucionawayiwa, Innovative Gateway Solutions ukampi

Cryptix revoluciona los pagos con criptomonedas en Europa con soluciones de pasarela innovadoras

A Cryptix innovatív átjárómegoldásaival forradalmasítja a kriptográfiai fizetéseket Európában

Cryptix は革新的なゲートウェイ ソリューションでヨーロッパの暗号通貨決済に革命を起こします

Cryptix Европадагы крипто төлөмдөрүн инновациялык шлюз чечимдери менен өзгөртөт

Cryptix revoluționează plățile cripto în Europa cu soluții inovatoare de gateway

Цриптик револуционише крипто плаћања у Европи са иновативним решењима мрежног пролаза

Cryptix бо ҳалли инноватсионии Gateway пардохтҳои криптоиро дар Аврупо инқилоб мекунад

Cryptix ปฏิวัติการชำระเงินด้วย Crypto ในยุโรปด้วยโซลูชันเกตเวย์ที่สร้างสรรค์

Cryptix революціонізує криптовалютні платежі в Європі за допомогою інноваційних рішень для шлюзу

I-Cryptix iguqula iiNtlawulo ze-Crypto eYurophu kunye ne-Innovative Gateway Solutions

In my talk, “Evolving your APIs,” I mention that an API gateway is a Reverse Proxy "on steroids.” One key difference between the former and the latter is that the API Gateway is not unfriendly to business logic. The poster child is rate-limiting. Rate-limiting is an age-old Reverse Proxy feature focused on protecting against Distributed Denial of Service (DDoS) attacks. It treats all clients the same and is purely technical. In this day and age, most API providers offer different subscription tiers; the higher the tier, the higher the rate limit, and the more you pay incidentally. It's not technical anymore and requires to differentiate between clients. In this post, I want to detail how to do it with Apache APISIX. Note I take most of the material from the workshop. Rate-limiting for the masses Apache APISIX offers no less than three plugins to rate limit requests: limit conn: limits the number of concurrent requests
limit req: limits the number of requests based on the Leaky Bucket algorithm
limit count: limits the number of requests based on a fixed time window The limit-count plugin is a good candidate for this post. Let's configure the plugin for a route: routes:
  - uri: /get
    upstream:
      nodes:
        "http://httpbin.org:80": 1
    plugins:
      limit-count:                     #1
        count: 1                       #2
        time_window: 60                #2
        rejected_code: 429             #3
#END Set the limit-count plugin
Limit requests to one every 60 seconds
Override the default HTTP response code, i.e., 503 At this point, we configured regular rate limiting. curl -v http://localhost:9080/get
curl -v http://localhost:9080/get If we execute the second request before a minute has passed, the result is the following: HTTP/1.1 429 Too Many Requests
Date: Tue, 09 Jul 2024 06:55:07 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 241
Connection: keep-alive
X-RateLimit-Limit: 1                   #1
X-RateLimit-Remaining: 0               #2
X-RateLimit-Reset: 59                  #3
Server: APISIX/3.9.1

<html>
<head><title>429 Too Many Requests</title></head>
<body>
<center><h1>429 Too Many Requests</h1></center>
<hr><center>openresty</center>
<p><em>Powered by <a href="https://apisix.apache.org/">APISIX</a>.</em></p></body>
</html> Configured limit
Remaining quota
Waiting time in seconds before quota replenishment Per-consumer rate limiting To configure per-consumer rate limiting, we first need to implement request authentication. APISIX offers many authentication plugins; we shall use the simplest one, key-auth. key-auth checks a specific HTTP request header - apikey by default. Here's how we configure consumers: consumers:
  - username: johndoe                  #1
    plugins:
      key-auth:
        key: john                      #2
  - username: janedoe                  #1
    plugins:
      key-auth:
        key: jane                      #2 Users
HTTP header request value curl -H 'apikey: john' localhost:9080/get #1
curl -H 'apikey: jane' localhost:9080/get #2 Authenticate as johndoe
Authenticate as janedoe In general, you attach plugins to APISIX routes but can also attach them to consumers. We can now move the limit-count plugin. routes:
  - uri: /get
    upstream:
      nodes:
        "httpbin:80": 1
    plugins:
      key-auth: ~                      #1

consumers:
  - username: johndoe
    plugins:
      key-auth:
        key: john
      limit-count:
        count: 1                       #2
        time_window: 60
        rejected_code: 429
  - username: janedoe
    plugins:
      key-auth:
        key: jane
      limit-count:
        count: 5                       #2
        time_window: 60
        rejected_code: 429
#END The route is only accessible to requests authenticating with key-auth
johndoe has a lower limit count than janedoe. Did he forget to pay his subscription fees? curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get The second request gets rate-limited. Per-group rate limiting We never attach permissions directly to identities in Identity Management systems. It's considered bad practice because when a person moves around the organization, we need to add and remove permissions one by one. The good practice is to attach permissions to groups and set the person in that group. When the person moves, we change their group; the person loses permissions from the old group and gets permissions from the new group. People get their permissions transitively via their groups. Apache APISIX offers an abstraction called a Consumer Group for this. Let's create two consumer groups with different rate limit values: consumer_groups:
  - id: 1
    plugins:
      limit-count:
        count: 1
        time_window: 60
        rejected_code: 429
  - id: 2
    plugins:
      limit-count:
        count: 5
        time_window: 60
        rejected_code: 429 The next step is to attach consumers to these groups: consumers:
  - username: johndoe
    group_id: 1
    plugins:
      key-auth:
        key: john
  - username: janedoe
    group_id: 2
    plugins:
      key-auth:
        key: jane curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get The second request gets rate-limited. We have the same results as before with two benefits. The first one is as I wrote above: when consumers move in and out, they change their permissions accordingly. The second benefit is that the limit count is shared among all consumers of a group.  Indeed, when you set a limit, you don't want each consumer to be rate limited at X requests per Y second; you want the group as a whole to share the limit. In this way, if a single consumer is very active, they will naturally cap the rate of other consumers who share the same group. Of course, you can set a limit on both a consumer and the group it belongs to. In this case, the lowest limit will apply first. consumers:
  - username: johndoe
    group_id: 2                        #1  
    plugins:
      key-auth:
        key: john
      limit-count:
        count: 1                       #2
        time_window: 60
        rejected_code: 429
  - username: janedoe
    group_id: 2
    plugins:
      key-auth:
        key: jane Move johndoe to group 2
Limit him individually curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: john' localhost:9080/get #1 johndoe hits the limit here, but janedoe now only has four requests left from this minute, as the former used one request Conclusion In this post, we implement rate limiting with Apache APISIX. We set the rate limit on a route and moved it to individual consumers. Then we moved it to consumer groups, so all consumers in a group share the same "pool". The complete source code for this post can be found on GitHub. To go further: Consumer
Consumer Group
Apache APISIX Hands-on Lab In my talk, “Evolving your APIs,” I mention that an API gateway is a Reverse Proxy "on steroids.” One key difference between the former and the latter is that the API Gateway is not unfriendly to business logic. The poster child is rate-limiting. Rate-limiting is an age-old Reverse Proxy feature focused on protecting against Distributed Denial of Service (DDoS) attacks. It treats all clients the same and is purely technical. In this day and age, most API providers offer different subscription tiers; the higher the tier, the higher the rate limit, and the more you pay incidentally. It's not technical anymore and requires to differentiate between clients. In this post, I want to detail how to do it with Apache APISIX. Note I take most of the material from the workshop . workshop Rate-limiting for the masses Apache APISIX offers no less than three plugins to rate limit requests: limit conn: limits the number of concurrent requests limit req: limits the number of requests based on the Leaky Bucket algorithm limit count: limits the number of requests based on a fixed time window limit conn : limits the number of concurrent requests limit conn limit req : limits the number of requests based on the Leaky Bucket algorithm limit req Leaky Bucket limit count : limits the number of requests based on a fixed time window limit count The limit-count plugin is a good candidate for this post. limit-count Let's configure the plugin for a route: routes:
  - uri: /get
    upstream:
      nodes:
        "http://httpbin.org:80": 1
    plugins:
      limit-count:                     #1
        count: 1                       #2
        time_window: 60                #2
        rejected_code: 429             #3
#END routes:
  - uri: /get
    upstream:
      nodes:
        "http://httpbin.org:80": 1
    plugins:
      limit-count:                     #1
        count: 1                       #2
        time_window: 60                #2
        rejected_code: 429             #3
#END Set the limit-count plugin Limit requests to one every 60 seconds Override the default HTTP response code, i.e., 503 Set the limit-count plugin limit-count Limit requests to one every 60 seconds Override the default HTTP response code, i.e. , 503 i.e. 503 At this point, we configured regular rate limiting. curl -v http://localhost:9080/get
curl -v http://localhost:9080/get curl -v http://localhost:9080/get
curl -v http://localhost:9080/get If we execute the second request before a minute has passed, the result is the following: HTTP/1.1 429 Too Many Requests
Date: Tue, 09 Jul 2024 06:55:07 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 241
Connection: keep-alive
X-RateLimit-Limit: 1                   #1
X-RateLimit-Remaining: 0               #2
X-RateLimit-Reset: 59                  #3
Server: APISIX/3.9.1

<html>
<head><title>429 Too Many Requests</title></head>
<body>
<center><h1>429 Too Many Requests</h1></center>
<hr><center>openresty</center>
<p><em>Powered by <a href="https://apisix.apache.org/">APISIX</a>.</em></p></body>
</html> HTTP/1.1 429 Too Many Requests
Date: Tue, 09 Jul 2024 06:55:07 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 241
Connection: keep-alive
X-RateLimit-Limit: 1                   #1
X-RateLimit-Remaining: 0               #2
X-RateLimit-Reset: 59                  #3
Server: APISIX/3.9.1

<html>
<head><title>429 Too Many Requests</title></head>
<body>
<center><h1>429 Too Many Requests</h1></center>
<hr><center>openresty</center>
<p><em>Powered by <a href="https://apisix.apache.org/">APISIX</a>.</em></p></body>
</html> Configured limit Remaining quota Waiting time in seconds before quota replenishment Configured limit Remaining quota Waiting time in seconds before quota replenishment Per-consumer rate limiting To configure per-consumer rate limiting, we first need to implement request authentication. APISIX offers many authentication plugins; we shall use the simplest one, key-auth . key-auth checks a specific HTTP request header - apikey by default. key-auth key-auth apikey Here's how we configure consumers: consumers:
  - username: johndoe                  #1
    plugins:
      key-auth:
        key: john                      #2
  - username: janedoe                  #1
    plugins:
      key-auth:
        key: jane                      #2 consumers:
  - username: johndoe                  #1
    plugins:
      key-auth:
        key: john                      #2
  - username: janedoe                  #1
    plugins:
      key-auth:
        key: jane                      #2 Users HTTP header request value Users HTTP header request value curl -H 'apikey: john' localhost:9080/get #1
curl -H 'apikey: jane' localhost:9080/get #2 curl -H 'apikey: john' localhost:9080/get #1
curl -H 'apikey: jane' localhost:9080/get #2 Authenticate as johndoe Authenticate as janedoe Authenticate as johndoe johndoe Authenticate as janedoe janedoe In general, you attach plugins to APISIX routes but can also attach them to consumers. We can now move the limit-count plugin. limit-count routes:
  - uri: /get
    upstream:
      nodes:
        "httpbin:80": 1
    plugins:
      key-auth: ~                      #1

consumers:
  - username: johndoe
    plugins:
      key-auth:
        key: john
      limit-count:
        count: 1                       #2
        time_window: 60
        rejected_code: 429
  - username: janedoe
    plugins:
      key-auth:
        key: jane
      limit-count:
        count: 5                       #2
        time_window: 60
        rejected_code: 429
#END routes:
  - uri: /get
    upstream:
      nodes:
        "httpbin:80": 1
    plugins:
      key-auth: ~                      #1

consumers:
  - username: johndoe
    plugins:
      key-auth:
        key: john
      limit-count:
        count: 1                       #2
        time_window: 60
        rejected_code: 429
  - username: janedoe
    plugins:
      key-auth:
        key: jane
      limit-count:
        count: 5                       #2
        time_window: 60
        rejected_code: 429
#END The route is only accessible to requests authenticating with key-auth johndoe has a lower limit count than janedoe. Did he forget to pay his subscription fees? The route is only accessible to requests authenticating with key-auth key-auth johndoe has a lower limit count than janedoe . Did he forget to pay his subscription fees? johndoe janedoe curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get The second request gets rate-limited. Per-group rate limiting We never attach permissions directly to identities in Identity Management systems. It's considered bad practice because when a person moves around the organization, we need to add and remove permissions one by one. The good practice is to attach permissions to groups and set the person in that group. When the person moves, we change their group; the person loses permissions from the old group and gets permissions from the new group. People get their permissions transitively via their groups. transitively Apache APISIX offers an abstraction called a Consumer Group for this. Consumer Group Let's create two consumer groups with different rate limit values: consumer_groups:
  - id: 1
    plugins:
      limit-count:
        count: 1
        time_window: 60
        rejected_code: 429
  - id: 2
    plugins:
      limit-count:
        count: 5
        time_window: 60
        rejected_code: 429 consumer_groups:
  - id: 1
    plugins:
      limit-count:
        count: 1
        time_window: 60
        rejected_code: 429
  - id: 2
    plugins:
      limit-count:
        count: 5
        time_window: 60
        rejected_code: 429 The next step is to attach consumers to these groups: consumers:
  - username: johndoe
    group_id: 1
    plugins:
      key-auth:
        key: john
  - username: janedoe
    group_id: 2
    plugins:
      key-auth:
        key: jane consumers:
  - username: johndoe
    group_id: 1
    plugins:
      key-auth:
        key: john
  - username: janedoe
    group_id: 2
    plugins:
      key-auth:
        key: jane curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get
curl -H 'apikey: jane' localhost:9080/get The second request gets rate-limited. We have the same results as before with two benefits. The first one is as I wrote above: when consumers move in and out, they change their permissions accordingly. The second benefit is that the limit count is shared among all consumers of a group.  Indeed, when you set a limit, you don't want each consumer to be rate limited at X requests per Y second; you want the group as a whole to share the limit. In this way, if a single consumer is very active, they will naturally cap the rate of other consumers who share the same group. Of course, you can set a limit on both a consumer and the group it belongs to. In this case, the lowest limit will apply first. consumers:
  - username: johndoe
    group_id: 2                        #1  
    plugins:
      key-auth:
        key: john
      limit-count:
        count: 1                       #2
        time_window: 60
        rejected_code: 429
  - username: janedoe
    group_id: 2
    plugins:
      key-auth:
        key: jane consumers:
  - username: johndoe
    group_id: 2                        #1  
    plugins:
      key-auth:
        key: john
      limit-count:
        count: 1                       #2
        time_window: 60
        rejected_code: 429
  - username: janedoe
    group_id: 2
    plugins:
      key-auth:
        key: jane Move johndoe to group 2 Limit him individually Move johndoe to group 2 johndoe Limit him individually curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: john' localhost:9080/get #1 curl -H 'apikey: john' localhost:9080/get
curl -H 'apikey: john' localhost:9080/get #1 johndoe hits the limit here, but janedoe now only has four requests left from this minute, as the former used one request johndoe hits the limit here, but janedoe now only has four requests left from this minute, as the former used one request johndoe janedoe Conclusion In this post, we implement rate limiting with Apache APISIX. We set the rate limit on a route and moved it to individual consumers. Then we moved it to consumer groups, so all consumers in a group share the same "pool". The complete source code for this post can be found on GitHub . GitHub To go further: To go further: Consumer Consumer Group Apache APISIX Hands-on Lab Consumer Consumer Consumer Group Consumer Group Apache APISIX Hands-on Lab Apache APISIX Hands-on Lab

Advanced Rate Limiting with Apache APISIX: Optimizing API Gateway Performance

Ola: More Than Infrastructure - A New Gateway Connecting Web2 and Web3 Worlds

ওলা: অবকাঠামোর চেয়েও বেশি - ওয়েব2 এবং ওয়েব3 ওয়ার্ল্ডকে সংযুক্ত করার একটি নতুন গেটওয়ে

Ola: Mehr als Infrastruktur – Ein neues Gateway, das die Web2- und Web3-Welten verbindet

Ola: Más que infraestructura: una nueva puerta de enlace que conecta los mundos Web2 y Web3

Ola : Plus qu'une infrastructure - Une nouvelle passerelle reliant les mondes Web2 et Web3

ओला: बुनियादी ढांचे से कहीं अधिक - वेब2 और वेब3 दुनिया को जोड़ने वाला एक नया प्रवेशद्वार

Ola: 単なるインフラストラクチャ以上のもの - Web2 と Web3 の世界をつなぐ新しいゲートウェイ

Ola: 인프라 그 이상 - Web2와 Web3 세계를 연결하는 새로운 게이트웨이

Ola: Mais que infraestrutura – um novo gateway conectando os mundos Web2 e Web3

Ола: Больше, чем инфраструктура: новый шлюз, соединяющий миры Web2 и Web3

Ola: Altyapıdan Daha Fazlası - Web2 ve Web3 Dünyalarını Birleştiren Yeni Bir Ağ Geçidi

Ola: Hơn cả cơ sở hạ tầng - Một cổng mới kết nối thế giới Web2 và Web3

Ola：不仅仅是基础设施——连接 Web2 和 Web3 世界的新网关

Getting Started With Linux: Your Gateway to the Open-Source Realm

**TOKYO, Japan, May 8th, 2024/Chainwire/--**Slash Vision Labs is thrilled to introduce SVL Alpha-Base (’Alpha-Base’), an innovative addition to the SVL Portal tailored to offer SVL token stakers exclusive alpha opportunities from our esteemed partner projects. Alpha-Base represents a significant leap forward in our mission to empower and engage our community. By partnering with leading projects in the crypto space, Slash Vision Labs will create exclusive alpha opportunities for SVL token stakers, offering early access to token launches and potential airdrops. With three notable projects already onboarded and one more set to be announced in the coming days, Alpha-Base is poised to become the go-to destination for those seeking to stay ahead of the curve. Through SVL Alpha-Base, SVL token stakers will gain access to exclusive opportunities while our partner projects gain an active community already onboarded onto SVL. By bringing a vibrant and active community of SVL to their projects, our partners can benefit from increased engagement and participation in their platform and upcoming token launches. "Our mission with SVL Alpha-Base is to provide our community with the tools and opportunities needed to thrive in the ever-evolving crypto landscape. We aim to create a unified ecosystem that unlocks massive opportunities for every participant of the SVL ecosystem.”— Shinsuke Sato, Founder of Slash Vision Labs. Stay tuned for further updates and announcements as we prepare to launch SVL Alpha-Base and onboard many promising new projects. About Slash Vision Labs SVL (Slash Vision Labs) is pioneering the transformation of the cryptocurrency payments landscape with its innovative ecosystem, built on the Mantle Network. Embracing decentralization and community empowerment, SVL redistributes 100% of protocol fees back into the ecosystem, rewarding token stakers and fostering active participation. SVL's flagship products, Slash Card and Slash Payment, redefine the digital payments landscape. Slash Card, the first-ever compliant credit card in Japan, bridges fiat and crypto economies, offering unmatched convenience. Meanwhile, Slash Payment, a crypto-to-crypto swap payment solution, empowers over 4,000 merchants, processing over 200 million USD worth of crypto transactions. For media inquiries or further information, please contact: Masato Kato Business Development Slash Vision Labs hello@slash.vision Website | X | Discord | Medium | Whitepaper Contact Slash Team hello@slash.vision This story was distributed as a release by Chainwire under HackerNoon’s Business Blogging Program. Learn more about the program here. **TOKYO, Japan, May 8th, 2024/Chainwire/--**Slash Vision Labs is thrilled to introduce SVL Alpha-Base (’Alpha-Base’), an innovative addition to the SVL Portal tailored to offer SVL token stakers exclusive alpha opportunities from our esteemed partner projects. Alpha-Base represents a significant leap forward in our mission to empower and engage our community. By partnering with leading projects in the crypto space, Slash Vision Labs will create exclusive alpha opportunities for SVL token stakers, offering early access to token launches and potential airdrops. With three notable projects already onboarded and one more set to be announced in the coming days, Alpha-Base is poised to become the go-to destination for those seeking to stay ahead of the curve. Through SVL Alpha-Base, SVL token stakers will gain access to exclusive opportunities while our partner projects gain an active community already onboarded onto SVL. By bringing a vibrant and active community of SVL to their projects, our partners can benefit from increased engagement and participation in their platform and upcoming token launches. "Our mission with SVL Alpha-Base is to provide our community with the tools and opportunities needed to thrive in the ever-evolving crypto landscape. We aim to create a unified ecosystem that unlocks massive opportunities for every participant of the SVL ecosystem.”— Shinsuke Sato, Founder of Slash Vision Labs. "Our mission with SVL Alpha-Base is to provide our community with the tools and opportunities needed to thrive in the ever-evolving crypto landscape. We aim to create a unified ecosystem that unlocks massive opportunities for every participant of the SVL ecosystem.”— Shinsuke Sato, Founder of Slash Vision Labs. Stay tuned for further updates and announcements as we prepare to launch SVL Alpha-Base and onboard many promising new projects. About Slash Vision Labs SVL (Slash Vision Labs) is pioneering the transformation of the cryptocurrency payments landscape with its innovative ecosystem, built on the Mantle Network. Embracing decentralization and community empowerment, SVL redistributes 100% of protocol fees back into the ecosystem, rewarding token stakers and fostering active participation. SVL's flagship products, Slash Card and Slash Payment, redefine the digital payments landscape. Slash Card, the first-ever compliant credit card in Japan, bridges fiat and crypto economies, offering unmatched convenience. Meanwhile, Slash Payment, a crypto-to-crypto swap payment solution, empowers over 4,000 merchants, processing over 200 million USD worth of crypto transactions. For media inquiries or further information, please contact: Masato Kato Business Development Slash Vision Labs hello@slash.vision hello@slash.vision hello@slash.vision Website | X | Discord | Medium | Whitepaper Website Website X X Discord Discord Medium Medium Whitepaper Whitepaper Contact Slash Team hello@slash.vision This story was distributed as a release by Chainwire under HackerNoon’s Business Blogging Program. Learn more about the program here. This story was distributed as a release by Chainwire under HackerNoon’s Business Blogging Program. Learn more about the program here . here here

Slash Vision Labs Unveils SVL Alpha-Base: A New Gateway To Exclusive Alpha Opportunities

Lucas Hoffman, CTO at 0xProcessing, a crypto payment gateway for businesses with Web3 integration, uncovers the dependence of crypto transaction volume on market conditions, the popularity of auto-conversion into stablecoins, and calculates the share of BTC in crypto processing. Q: The cryptocurrency market is going through a big upswing again. Bitcoin recently reached a new high, and other cryptocurrencies are also doing well compared to last year. Has this affected the crypto processing market? How did the volume of payments change? This question is not about the dollar equivalent of TRX volume, which obviously went up just because the exchange rate grew sharply. 0x: The number of payments made through crypto payment gateways has been growing lately every year. Of course, when the price of Bitcoin goes up, more businesses become interested in accepting crypto payments. But even during the tough times for crypto in 2022-2023, we saw more people using crypto payment gateways. Our data shows that in the first quarter of 2021, over 200 thousand transactions went through 0xProcessing. By the end of the first quarter of 2022, even though Bitcoin's price dropped, we had already processed 1.5 million transactions. By the end of 2023, over 3.5 million transactions had been completed through 0xProcessing. By this April, 0x processed over 4.5 mln of transactions. The number of merchants has risen to 400+. This shows that more and more people want to use crypto for payments, both businesses offering it on their websites and users making the payments. Q: 0x was launched in 2020 supporting 5 blockchains and 15 coins. Now, it supports 13 blockchains and over 50 cryptocurrencies. Which blockchains are the most popular in B2C payment? Where do regular users have the most transactions? 0x: Among the most popular cryptocurrencies are BTC, ETH, BNB, DOGE, LTC, DASH, SOL, alongside stablecoins like USDT and DAI. When it comes to blockchains, users tend to favor networks with low fees, such as BNB Chain, TRON, and DOGE. Q: So, Bitcoin isn't the top choice for most merchants? 0x: Bitcoin holds a unique position. Due to its widespread use, merchants typically prioritize accepting Bitcoin payments. Consequently, despite its higher fees compared to other blockchains, Bitcoin still accounts for a significant share of crypto processing. According to our internal statistics, currently, transactions in BTC account for 26% of overall turnover through 0xProcessing. Q: What merchants are the main users of crypto payment gateways? 0x: Cryptoprocessing is particularly favored by merchants who operate globally, especially those in the virtual space, owing to its advantages in speed, low fees, and ability to handle international transactions. For example, VPN services, such as Eva VPN which operates globally and has hundreds of secure VPN servers around the world. Q: Why do businesses show interest in crypto payments despite the volatility of cryptocurrencies? 0x: Businesses such as gaming and betting platforms, subscription services, and global merchants seek fast electronic payments worldwide, beyond the confines of specific countries or regions. Their users require quick account replenishment, and crypto processing proves to be a much more convenient and faster method than traditional payment systems or bank transfers. The issue of cryptocurrency volatility in processing is not a problem anymore. Particularly, 0xProcessing addresses the volatility issue with its Volatility Risk Control System service. This service automatically converts crypto received as payment to stablecoins, safeguarding assets from market fluctuations. Merchants can choose the portion of crypto to convert into stablecoins and which share of the payment to retain as crypto. Q: Do merchants prefer immediate conversion to stablecoins upon receiving payments, or do they hold part of their assets in cryptocurrency? 0x: The preference for automatic conversion to stablecoins depends on market conditions. During bear markets, merchants tend to increase automatic conversion amounts to shield against cryptocurrency depreciation. Conversely, amidst recent bullish trends, the share of auto-conversion has notably declined. Merchants, akin to crypto investors, favor HODLing, anticipating enhanced profitability through the appreciation of accepted coins. Q: Can you compete with the large crypto processing companies in the market? 0x: In some cases, being affiliated with a major crypto exchange or belonging to a large holding can actually be detrimental to crypto processing. Crypto processing is inherently personal. Each merchant has unique needs and specific requests. A one-size-fits-all solution, like a generic product on a supermarket shelf, often falls short. Merchants require fast, simple, and cost-effective solutions tailored to their individual requirements. At 0xProcessing, we've embraced this personalized approach to client relationships. Our technical support team is available round-the-clock, ensuring prompt assistance. We take pride in our swift response times, with queries typically answered within 60 minutes. Additionally, our APIs are designed for easy customization, requiring no specialized programming knowledge, thus empowering merchants to configure them according to their preferences. Finally, the introduction of Web3 into crypto processing is our unique offer. Almost no one has anything like this on the market. Q: In 2021, 0xProcessing introduced Web3 wallet integration. How does this change crypto payment processing, and why is it considered more secure? 0x: With Web3 wallet integration, crypto payment processing becomes more streamlined and secure. This approach enables direct connection with users' Web3 wallets, enhancing security by minimizing intermediaries and facilitating seamless transactions directly from users' wallets. Lucas Hoffman, CTO at 0xProcessing, a crypto payment gateway for businesses with Web3 integration, uncovers the dependence of crypto transaction volume on market conditions, the popularity of auto-conversion into stablecoins, and calculates the share of BTC in crypto processing. Lucas Hoffman, CTO at 0xProcessing, a crypto payment gateway for businesses with Web3 integration, uncovers the dependence of crypto transaction volume on market conditions, the popularity of auto-conversion into stablecoins, and calculates the share of BTC in crypto processing. Lucas Hoffman, CTO at 0xProcessing , a crypto payment gateway for businesses with Web3 integration, uncovers the dependence of crypto transaction volume on market conditions, the popularity of auto-conversion into stablecoins, and calculates the share of BTC in crypto processing. 0xProcessing 0xProcessing Q: The cryptocurrency market is going through a big upswing again. Bitcoin recently reached a new high, and other cryptocurrencies are also doing well compared to last year. Has this affected the crypto processing market? How did the volume of payments change? This question is not about the dollar equivalent of TRX volume, which obviously went up just because the exchange rate grew sharply. Q: The cryptocurrency market is going through a big upswing again. Bitcoin recently reached a new high, and other cryptocurrencies are also doing well compared to last year. Has this affected the crypto processing market? How did the volume of payments change? This question is not about the dollar equivalent of TRX volume, which obviously went up just because the exchange rate grew sharply. 0x: The number of payments made through crypto payment gateways has been growing lately every year. Of course, when the price of Bitcoin goes up, more businesses become interested in accepting crypto payments. But even during the tough times for crypto in 2022-2023, we saw more people using crypto payment gateways. Our data shows that in the first quarter of 2021, over 200 thousand transactions went through 0xProcessing. By the end of the first quarter of 2022, even though Bitcoin's price dropped, we had already processed 1.5 million transactions. By the end of 2023, over 3.5 million transactions had been completed through 0xProcessing. By this April, 0x processed over 4.5 mln of transactions. The number of merchants has risen to 400+. This shows that more and more people want to use crypto for payments, both businesses offering it on their websites and users making the payments. Q: 0x was launched in 2020 supporting 5 blockchains and 15 coins. Now, it supports 13 blockchains and over 50 cryptocurrencies. Which blockchains are the most popular in B2C payment? Where do regular users have the most transactions? Q: 0x was launched in 2020 supporting 5 blockchains and 15 coins. Now, it supports 13 blockchains and over 50 cryptocurrencies. Which blockchains are the most popular in B2C payment? Where do regular users have the most transactions? 0x: Among the most popular cryptocurrencies are BTC, ETH, BNB, DOGE, LTC, DASH, SOL, alongside stablecoins like USDT and DAI. When it comes to blockchains, users tend to favor networks with low fees, such as BNB Chain, TRON, and DOGE. Q: So, Bitcoin isn't the top choice for most merchants? Q: So, Bitcoin isn't the top choice for most merchants? 0x: Bitcoin holds a unique position. Due to its widespread use, merchants typically prioritize accepting Bitcoin payments. Consequently, despite its higher fees compared to other blockchains, Bitcoin still accounts for a significant share of crypto processing. According to our internal statistics, currently, transactions in BTC account for 26% of overall turnover through 0xProcessing . 0xProcessing 0xProcessing Q: What merchants are the main users of crypto payment gateways? Q: What merchants are the main users of crypto payment gateways? 0x: Cryptoprocessing is particularly favored by merchants who operate globally, especially those in the virtual space, owing to its advantages in speed, low fees, and ability to handle international transactions. For example, VPN services, such as Eva VPN which operates globally and has hundreds of secure VPN servers around the world. Q: Why do businesses show interest in crypto payments despite the volatility of cryptocurrencies? Q: Why do businesses show interest in crypto payments despite the volatility of cryptocurrencies? 0x: Businesses such as gaming and betting platforms, subscription services, and global merchants seek fast electronic payments worldwide, beyond the confines of specific countries or regions. Their users require quick account replenishment, and crypto processing proves to be a much more convenient and faster method than traditional payment systems or bank transfers. The issue of cryptocurrency volatility in processing is not a problem anymore. Particularly, 0xProcessing addresses the volatility issue with its Volatility Risk Control System service. This service automatically converts crypto received as payment to stablecoins, safeguarding assets from market fluctuations. Merchants can choose the portion of crypto to convert into stablecoins and which share of the payment to retain as crypto. Q: Do merchants prefer immediate conversion to stablecoins upon receiving payments, or do they hold part of their assets in cryptocurrency? Q: Do merchants prefer immediate conversion to stablecoins upon receiving payments, or do they hold part of their assets in cryptocurrency? 0x: The preference for automatic conversion to stablecoins depends on market conditions. During bear markets, merchants tend to increase automatic conversion amounts to shield against cryptocurrency depreciation. Conversely, amidst recent bullish trends, the share of auto-conversion has notably declined. Merchants, akin to crypto investors, favor HODLing, anticipating enhanced profitability through the appreciation of accepted coins. Q: Can you compete with the large crypto processing companies in the market? Q: Can you compete with the large crypto processing companies in the market? 0x: In some cases, being affiliated with a major crypto exchange or belonging to a large holding can actually be detrimental to crypto processing. Crypto processing is inherently personal. Each merchant has unique needs and specific requests. A one-size-fits-all solution, like a generic product on a supermarket shelf, often falls short. Merchants require fast, simple, and cost-effective solutions tailored to their individual requirements. At 0xProcessing , we've embraced this personalized approach to client relationships. Our technical support team is available round-the-clock, ensuring prompt assistance. We take pride in our swift response times, with queries typically answered within 60 minutes. Additionally, our APIs are designed for easy customization, requiring no specialized programming knowledge, thus empowering merchants to configure them according to their preferences. 0xProcessing 0xProcessing Finally, the introduction of Web3 into crypto processing is our unique offer. Almost no one has anything like this on the market. Q: In 2021, 0xProcessing introduced Web3 wallet integration. How does this change crypto payment processing, and why is it considered more secure? Q: In 2021, 0xProcessing introduced Web3 wallet integration. How does this change crypto payment processing, and why is it considered more secure? 0x: With Web3 wallet integration, crypto payment processing becomes more streamlined and secure. This approach enables direct connection with users' Web3 wallets, enhancing security by minimizing intermediaries and facilitating seamless transactions directly from users' wallets.

0xProcessing: BTC Accounts for 26% of All Transactions Through Payment Gateway

The Open Worldwide Application Security Project is an online community that produces freely available articles, methodologies, documentation, tools, and technologies in the fields of IoT, system software and web application security. The OWASP provides free and open resources. It is led by a non-profit called The OWASP Foundation. The OWASP Top 10 - 2021 is the published result of recent research based on comprehensive data compiled from over 40 partner organizations. -- OWASP website The OWASP regularly publishes a Top 10 vulnerability report. The report targets vulnerabilities in web applications. In this post, I'd like to describe how to fix some of them via the . Apache APISIX API Gateway The OWASP Top 10 2021 In 2021, the report mentions: A01:2021-Broken Access Control A02:2021-Cryptographic Failures A03:2021-Injection A04:2021-Insecure A05:2021-Security Misconfiguration A06:2021-Vulnerable and Outdated Components A07:2021-Identification and Authentication Failures A08:2021-Software and Data Integrity Failures A09:2021-Security Logging and Monitoring Failures A10:2021-Server-Side Request Forgery For more details, please check the complete . report Fixing a vulnerability depends on its exact nature. For example, fixing is process-driven, requiring discipline in managing versions and retiring older ones. Some, however, are technical and only require proper configuration in the reverse proxy or API Gateway, , . Vulnerable and Outdated Components e.g. Server Side Request Forgery Nobody cares about security Security is a touchy subject because hardening security doesn't bring any value to the business. Career-driven managers won't care about security as they won't be able to showcase they increased the company's profit by X% on their next yearly evaluation. Unless the board considers security seriously, chances are nobody will care. For this reason, most organizations implement checkbox-based security, aka plausible deniability. If you're interested in implementing security properly, I've written some thoughts in a previous blog post: . Treat security as a risk All in all, securing applications will not get a lot of budget, if any. Hence, we must be smart about it and search for an existing component. Fortunately, the OWASP offers an out-of-the-box configuration to handle the Top 10, which is fixable via a configuration named . Unfortunately, it targets ModSecurity: Core Rule Set ModSecurity, sometimes called Modsec, is an open-source web application firewall (WAF). Originally designed as a module for the Apache HTTP Server, it has evolved to provide an array of Hypertext Transfer Protocol request and response filtering capabilities along with other security features across a number of different platforms including Apache HTTP Server, Microsoft IIS and Nginx. It is free software released under the Apache license 2.0. -- ModSecurity on Wikipedia While it's theoretically possible to configure Nnginx via Apache APISIX configuration, there's another more straightforward way. The OWASP Core Ruleset and Coraza The description of the Core Ruleset is pretty relevant to our needs: The OWASP® ModSecurity Core Rule Set (CRS) is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls. The CRS aims to protect web applications from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts. The CRS provides protection against many common attack categories, including: SQL Injection (SQLi) Cross Site Scripting (XSS) Local File Inclusion (LFI) Remote File Inclusion (RFI) PHP Code Injection Java Code Injection HTTPoxy Shellshock Unix/Windows Shell Injection Session Fixation Scripting/Scanner/Bot Detection Metadata/Error Leakages -- OWASP® ModSecurity Core Rule Set website OWASP also provides , a port of ModSecurity available as a Go library. is built on top of Coraza and implements the , which specifies a set of Wasm interfaces for proxies. Finally, Apache APISIX offers proxy-wasm integration. Coraza Coraza Proxy Wasm proxy-wasm ABI Putting it all together Let's sum up: The OWASP provides a list of the Top 10 web security vulnerabilities It implements them for ModSecurity via the Core Ruleset Coraza is a port of ModSecurity, available as a proxy-wasm implementation We can configure Apache APISIX with sane and secure defaults this way. Let's do it. First things first: Coraza isn't part of the Apache APISIX distribution. Yet, it's straightforward to add it here with Docker: FROM apache/apisix:3.8.0-debian

ENV VERSION 0.5.0                                                           #1
ENV CORAZA_FILENAME coraza-proxy-wasm-${VERSION}.zip                        #1

ADD https://github.com/corazawaf/coraza-proxy-wasm/releases/download/$VERSION/$CORAZA_FILENAME . #2

USER root                                                                   #3

RUN <<EOF

  apt-get install zip -y                                                    #4
  unzip $CORAZA_FILENAME -d /usr/local/apisix/proxywasm
  rm $CORAZA_FILENAME
  apt-get remove zip -y
  chown -R apisix:apisix /usr/local/apisix/proxywasm

EOF

USER apisix                                                                 #5 Define variables for better maintainability Get the Coraza Wasm release In recent APISIX versions, the user is to harden security. As we need to install packages, we must switch to . apisix root Install as it's not installed, unzip the downloaded archive, remove the archive, uninstall , and change the owner of the extracted folder unzip unzip Switch back to user apisix The next step is configuring APISIX itself to use the Coraza Wasm plugin. wasm:
  plugins:
    - name: coraza-filter                                                   #1
      priority: 7999                                                        #2
      file: /usr/local/apisix/proxywasm/coraza-proxy-wasm.wasm              #3 Filter's name set in Wasm code Set the highest priority so it runs before any other plugin Path to the extracted file, see the above Dockerfile Finally, we can assign the plugin to routes or set it as a global rule to apply to every route. I'm using static configuration: global_rules:
  - id: 1
    plugins:
      coraza-filter:                                                        #1
        conf:
          directives_map:                                                   #2
            default:
              - SecDebugLogLevel 9                                          #3
              - SecRuleEngine On                                            #4
              - Include @crs-setup-conf                                     #5
              - Include @owasp_crs/*.conf                                   #6
          default_directives: default                                       #7 Configure the plugin now that it's available coraza-filter Define configurations. Here, we define a single one, , but we could define several and use different ones in different routes default Increase the log level to see what happens in logs Switch on the engine Use Coraza setup Use all rules. We could pick and choose the ones we want for more fine-grained control Use the configuration defined above default We proceed to define routes to to test our setup. Let's call the route to : https://httpbin.org/ /get curl localhost:9080?user=foobar The response is as expected: {
  "args": {
    "user": "foobar"
  }, 
  "headers": {
    "Accept": "*/*", 
    "Host": "localhost", 
    "User-Agent": "curl/8.4.0", 
    "X-Amzn-Trace-Id": "Root=1-65b9fa13-75900dc029e156ec764ae204", 
    "X-Forwarded-Host": "localhost"
  }, 
  "origin": "192.168.65.1, 176.153.7.175", 
  "url": "http://localhost/get?user=foobar"
} Now, let's try to send JavaScript in the query string. There's no way this request is expected server-side, so our infrastructure should protect us from it. curl 'localhost:9080?user=<script>alert(1)</script>' The response is a 403 HTTP status code. If we look at the log, we can see the following hints: Coraza: Warning. XSS Attack Detected via libinjection [file "@owasp_crs/REQUEST-941-APPLICATION-ATTACK-XSS.conf"]
Coraza: Warning. NoScript XSS InjectionChecker: HTML Injection
Coraza: Warning. Javascript method detected
Coraza: Access denied (phase 1). Inbound Anomaly Score Exceeded in phase 1 Coraza did the job! Conclusion Most organizations don't incentivize for security. Hence, we need to be smart about it and use existing components as much as possible. We can harden Apache APISIX against the OWASP Top 10 by using Coraza and the Core Ruleset. To go further: OWASP Security Top 10 OWASP ModSecurity Core Ruleset OWASP Coraza WAF APISIX - Integrate with Coraza The complete source code for this post can be found on . GitHub Originally published at on February 4th, 2024 A Java Geek

How to Address Web Vulnerabilities With Apache APISIX API Gateway

Apache APISIX API গেটওয়ে দিয়ে কীভাবে ওয়েব দুর্বলতাগুলি মোকাবেলা করবেন

So beheben Sie Web-Schwachstellen mit dem Apache APISIX API Gateway

Cómo abordar las vulnerabilidades web con Apache APISIX API Gateway

Comment remédier aux vulnérabilités Web avec Apache APISIX API Gateway

अपाचे एपीआईएसआईएक्स एपीआई गेटवे के साथ वेब कमजोरियों को कैसे संबोधित करें

Apache APISIX API ゲートウェイを使用して Web の脆弱性に対処する方法

Apache APISIX API 게이트웨이를 사용하여 웹 취약점을 해결하는 방법

Como resolver vulnerabilidades da Web com Apache APISIX API Gateway

Как устранить веб-уязвимости с помощью API-шлюза Apache APISIX

Apache APISIX API Ağ Geçidi ile Web Güvenlik Açıkları Nasıl Giderilir?

Cách giải quyết các lỗ hổng web bằng cổng API APISIX của Apache

如何使用 Apache APISIX API 网关解决 Web 漏洞

Especially when talking about , many articles and videos focus on an architectural element that, in their opinion, is absolutely necessary for building such kinds of applications: . microservices API Gateways Yes, they are actually useful, but they are not the solution to every architectural problem. In this article, we will learn what API Gateways are, their pros and cons, why you should distinguish them from Load Balancers, and more. What is an API Gateway? Imagine that your application is made of several web services and APIs. Each of them will be deployed on a separate host, therefore having a different URL. While it can be helpful for internal development - you have a clear separation of operations available in your system - it can become cumbersome for the developers who have to integrate all those endpoints in their application. That’s where API Gateways come into play: they to uniform the access to your system. add a sort of in front of your set of APIs façade Say that you’ve built a Hotel booking system that is made of 3 services: , deployed at BookingAPI https://bookings.mycompany.org/api , deployed at SearchAPI https://mycompany.org/search/api , deployed at (notice the ) DiscountAPI https://discounts.mycompany.org/v1/api v1 By adding an API Gateway, you can hide these APIs behind a single host, like , mapping the route path to the original services’ URLs. https://api.mycompany.org/ As with everything in the world, there are advantages and disadvantages. Let’s learn! 🔥 Advantages of an API Gateway API Gateways have lots of advantages. It’s not a coincidence that they are being used in many architectures. Let’s see some of the best characteristics of an API Gateway. Internal API security Since your internal APIs are hidden behind an API Gateway, you make them discoverable by intruders who might want to access your systems and data. less Let’s go back to the Hotel Booking system in our example. External users will only see the host without knowing the structure of the internal API services. This . api.mycompany.com reduces the attack surface You can also by adding them to the API Gateway and have them applied to all the APIs behind the Gateway. centralize Access Control Policies Finally, you can and analyze the traffic to spot unusual behavior in a single place. monitor all the incoming requests Reduced complexity Some concerns are common to all the APIs within the same system, such as , , and . rate limiting throttling access control With API Gateways, you can for such common concerns in a single point. For example, once you have defined some rate limiting policies on your Gateway, you can have the same settings automatically applied to every internal API endpoint (well, not “physically” applied to the internal APIs, but since the Gateway blocks some incoming requests, they will not reach the internal systems as well). centralize the settings API Gateways also help with : since you have all the internal services listed in the API Gateway, just by looking at its configurations, you can see the list of the deployed APIs and their hostname. service documentation Flexibility Since API Gateways act as a façade in front of other services, you can integrate services that work with . different protocols or formats For example, you can have one service that exposes GraphQL APIs, another one that works with GRPC, and have them all exposed as REST APIs using the API Gateway as a wrapper/converter to and from such formats. Hiding the actual API endpoints behind a Gateway also allows you to , which is a technique that will enable you to aggregate the results from different internal API calls and return the caller only the final result (as opposed as making the client call each single service and compose the result afterwards). implement API Composition Enhanced performance Depending on the vendor, you can have different tools to improve the overall performance. For example, you can to get quicker response times, or you can apply uniformed . cache responses data compressions Some vendors allow you to have multiple instances of the same service available behind the API Gateway, acting as a sort of Load Balancer. Another powerful technique you can implement is . In a simple architecture, if you have to communicate securely with three systems to aggregate the result, you have to validate the SSL connection three times. With , you can move these operations on the API Gateway component and avoid doing that in all the other services, making the application more performant. SSL Termination SSL Termination Disadvantages Single point of failure Since we placed an API Gateway in front of all the other API applications, all the external communication passes through the API Gateway. This means that , even though the single APIs are still up and running. if the API Gateway is unavailable, the whole system becomes unavailable as well So, when using an API Gateway: : an error in the configurations can have consequences on the whole system; Beware of the settings Ensure that the Gateway is capable of handling the incoming load of requests: if the API Gateway cannot cope with the number of incoming requests, it may become unavailable and make the whole system offline. Ensure that you have some (see the previous point). protection against DDoS attacks Increased latency An API Gateway is an in the API processing: when a client wants to call an API application, all requests must first pass through the API Gateway, which, in turn, will call the internal API. additional hop This processing, this routing, adds some network latency. Maybe it’s not noticeable, but it depends on the Gateway you choose, the underlying infrastructure, and the processing done by the Gateway. Vendor Lock-in Once you have deployed and configured an API Gateway, moving to another vendor might be difficult. You risk vendor lock-in, with all the consequences: if the price goes up or if they remove some functionalities that you need, you will have to come up with a solution to migrate that specific part of your infrastructure to another vendor. It might not be so easy - some straightforward ways to mitigate the risk are to and to that validate the routing and the functionalities. make your systems platform agnostic create e2e tests API Gateway VS Load Balancer Some people I know and the authors of some articles I read use API Gateway and Load Balancer as synonyms. Let me get it straight: they are not the same! Yes, they both are components that work with incoming requests. But they serve two totally different purposes. While Load Balancers “just” spread incoming requests across multiple instances of the same service, API Gateways act as a façade in front of different types of services. They are two totally different components of an architecture. Some vendors provide both functionalities, while others don’t. So, keep the two meanings distinct, and try to use the correct wording. API Gateway vendors comparison Here is a list of some API Gateway vendors’ prices, pros, and cons. Notice: . The info in this list comes primarily from their official documentation and, in some cases, from other resources that compare such products. I have yet to try all these vendors : it’s an Open Source product that provides features such as authentication, rate limiting, logging, caching, and more. It is written in Lua and runs on top of Nginx. Kong Price: Kong offers free community and paid enterprise editions. Pros: Kong is easy to install and configure, supports many plugins and integrations, and has a large and active community. Cons: Kong may have performance issues when handling large volumes of traffic, requires Nginx as a dependency, and has limited support for GraphQL, which is available only for the enterprise edition. : it’s a lightweight API Gateway written in Go. It offers API analytics, a developer portal, a dashboard, security, and other features. It can be deployed on-premises, in the cloud, or as a hybrid. Tyk Price: Tyk offers a 5-week free trial and four payment tiers. The Starter edition costs $600 per month for up to 10 million API calls. Pros: Tyk is fast, scalable, and flexible and has a rich set of features and plugins. Cons: Even though Tyk is open source, it has no free tier. : an API Gateway that is based on Express.js. It provides a single package with dynamic routing, access control, and API management. It is written in JavaScript. Express Gateway Price: Express Gateway is free and open source. Pros: Express Gateway is simple to use and customize, supports the Node.js ecosystem and middleware, and can be easily extended with plugins. Cons: Express Gateway may not be suitable for complex scenarios, as it lacks some advanced features such as caching (which is in the Medium Term roadmap). : an open-source API Gateway that is part of the Netflix OSS stack. It provides dynamic routing, resiliency, security, and monitoring for microservices. It is written in Java and can be integrated with other Netflix components. Zuul Price: Zuul is free and open source. Pros: Zuul is robust, reliable, and battle-tested by Netflix and supports filters for request processing. Cons: Zuul has limited documentation. : it offers features such as a developer portal, Gateway, policies, throttling, caching, and more. Azure API Management Price: Azure API Management offers a free tier and several paid tiers. The paid tiers start from $0.07 per hour for the Developer tier and go up to $3.83 per hour for the Premium tier. Pros: Azure API Management is easy to integrate with other Azure services, supports multiple protocols and formats, and has a rich set of features and policies. Cons: Azure API Management may have a complex pricing model, and it requires Azure Active Directory for authentication. : It provides complete lifecycle API management, from design and development to security and analytics. Amazon API Gateway Price: Amazon API Gateway offers a free tier and a pay-as-you-go model. The pay-as-you-go model charges per million API calls received, plus data transfer and caching fees. Pros: Amazon API Gateway is scalable, reliable, and secure; it supports serverless architectures and WebSocket APIs. Cons: Amazon API Gateway may have a steep learning curve for beginners, requires AWS Lambda for custom logic, and has limited documentation and support. It has a complex pricing tier. : It supports OpenAPI Specification v2 and gRPC APIs. Google Cloud API Gateway Price: Google Cloud API Gateway offers tiers based on the number of API calls. From 0 to 2 million calls, the service is free. From 2 million to 1 billion calls, you pay $3.00 per million API calls, while from 1 billion on, you pay $1.5 per million API calls. Pros: Google Cloud API Gateway is easy to use and deploy, supports multiple authentication methods and protocols, and integrates well with other Google Cloud services. Cons: It has limited plugins and integrations. Further readings It’s not the first time we talked about API Gateways in this blog: in fact, there’s an old article where I shared some things I learned about API Gateways the first time I heard about them: 🔗 API Gateways - an overview | Code4IT We also learned how to use Azure API Management to integrate the API Gateways product provided by Azure to organize some .NET APIs. 🔗 How to create an API Gateway using Azure API Management | Code4IT This article taught us that API Gateways are different from Load Balancers. Do you know what are some types of Load Balancers and why you should care? 🔗 Davide’s Code and Architecture Notes - L4 vs L7 Load Balancer | Code4IT Wrapping up Beware those who say that API Gateways are «the best thing to add to a microservice architecture»! As we learned, there are some downsides, too. Always make sure that the products and the components you choose fit your necessities and that you learn when something is for you. not I hope you enjoyed this article! Let’s keep in touch on or ! 🤜🤛 Twitter LinkedIn Happy coding! 🐧 Also published . here

A Guide to API Gateways: Unveiling Advantages, Disadvantages, and Vendor Comparisons

Build DevOps for Secure Auth API Gateway using Nodejs, Aptible Terraform and Redis

The race to the billion-dollar crypto market is still viewed by some people as a wild goose chase due to the complexity surrounding technology. blockchain In other words, there are those who argue that abstracting blockchain into the background is the first step to mass adoption. In this interview, CTO and Co-founder of Gateway.fm Igor Mandrigin delved into blockchain abstraction and Gateway.fm, his pet project. Hi Igor, thanks for joining us today. How do you assess the evolution of the blockchain regulatory environment? During the relatively nascent history of blockchain technology, there has been a significant risk of both under-regulation and over-regulation, adding complexity to companies trying to fast-track innovation while staying within regulatory parameters. Following a year blighted by numerous Black Swan events, heightened regulatory scrutiny can be expected. Looking ahead, Web3 projects will likely face more stringent regulations, and while this may slow down the pace of innovation, it will help the industry become more secure and trustworthy in the eyes of mainstream users, who may have been averse to exploring the space to date. Can you tell us a bit about Gateway.fm and what inspired you? Gateway.fm is a truly decentralized blockchain infrastructure node provider, delivering reliable node infrastructure, best-in-class validators and robust dev tooling to help Web3 projects scale at pace. We are firmly committed to democratizing access to scalable Web3 infrastructure, while empowering developers to do their best work in a supportive and purpose-built environment. By spreading RPC infrastructure across multiple independent data centers, the network becomes less reliant on any one data center, reducing the risk of a single point of failure. My co-founder Cuautemoc Weber and I launched Gateway.fm to build decentralized RPC solutions that don’t rely on centralized services like Amazon Web Services. We ultimately wanted to disrupt the status quo node infrastructure landscape and to provide diversity and decentralized access in line with the spirit of Web3. We could see there was massive pent-up market demand for infrastructure services supporting multiple blockchains. At Gateway, our focus since day one has been to simplify the complexities of crypto while accelerating deployment capabilities, enhancing security, and making blockchain more fun and accessible to a wider audience. This is what we’re aiming to achieve with the recent launch of Presto, a Zero-knowledge based Web3 platform as-a-service. Speaking of Presto. What is it all about? Presto is designed to greatly simplify deploying and operating Zero-knowledge rollups, allowing any non-crypto user to deploy a state-of-the-art full E2E zk-validium or zk-rollup within a couple of clicks and minutes. We already pre-integrate a lot of necessary tooling from the start, such as explorers, faucets, developer tools, data availability, and many more ancillary services, which will simplify the life of many developers and projects, allowing them to focus further on the actual use cases than on the underlying tech. With Presto, we alleviate the significant challenges associated with deploying the infrastructure, smart contracts, and tools required to establish a fully operational zk-rollup in production, which normally is an onerous and time-consuming process. Currently, we manage about 30 microservices, with more features and functionalities being added on an ongoing basis. These intricate systems consist of numerous interconnected microservices operating synchronously to facilitate the seamless user experience.” Can you share a practical example? Let’s start with a throwback example. The process of building a website during the 90s was extremely complex and pretty much only reserved for web developers. Fast forward to today, anyone can create fully functional websites without even thinking of the underlying architecture. With Presto, this is exactly the type of paradigm shift we want to enable for blockchain technology – making it accessible and simple to use and build on top of. Is Presto chain-agnostic? Yes, which means Presto can work with a range of Layer 1 (L1) chains. Right now, we leverage the security of Ethereum or other L1 chains, such as Gnosis Chain, which allows Presto to build a higher-level chain with purpose-built prerequisites – creating a Layer 2 (L2) or Layer 3 (L3) solution. As our platform evolves, we’ll be extending support to additional chains, enhancing Presto’s multi-chain capabilities while offering users greater choice and flexibility.” Do you support the call for the abstraction of blockchain? Absolutely, yes! Blockchain should be abstracted away into the background. Through the abstraction of intricate technical details, developers and enterprises can effortlessly use the most advanced technology that blockchain can offer, all without the need for extensive knowledge in cryptography or blockchain protocols. Presto further simplifies the establishment and upkeep of blockchain networks, lowering entry barriers for businesses seeking to tap into the potential of blockchain – fostering faster adoption and implementation of blockchain technology. Looking ahead, what plans are in the pipeline at Gateway.fm? We’ll continue to expedite product development, explore value-driven partnerships with like-minded ecosystem players, and develop more solutions that can help traditional financial institutions and enterprises segway into the blockchain space. Ultimately, we want to put our deep-level infrastructure knowledge and core development experience to work in serving the top DeFi solutions in the decentralized space. How can Web3 projects demonstrate a commitment to security? Web3 projects should always aim to maintain the highest standards of security to maintain and build trust with their consumer base. Steps that can be taken include implementing multi-factor authentication, cold storage for digital assets, and regular security audits. By clearly communicating the rationale behind these measures, Web3 projects can demonstrate a commitment to user security.  It’s also important to provide robust customer support to address queries and concerns seamlessly, helping particularly new users to navigate the complexity of engaging with Web3 services for the first time.

"Blockchain Technology  Should Be Abstracted Into The Background” : Gateway.fm CTO Igor Mandrigin

Stories, News & Mentions about GATEWAY

Gateway’s Stories on HackerNoon

Gateway's News & Mentions