Securing the gateway itself: the Admin and Control APIs, etcd, TLS and certificates, encryption of stored secrets, WAF integration, request limits and header trust.
Keeping configuration endpoints away from attackers: admin key generation, the allow_admin IP list, binding ports 9180, 9092 and 9091 to private networks, decoupled control planes, and admin key requirements added in 3.17.
Encrypting and authenticating the control path: Admin API mTLS certificates, etcd client certificates and trusted CAs, binding etcd to private interfaces and protecting the configuration store that every gateway node trusts.
Encrypting traffic from the gateway to services: upstream TLS verification honored for https and grpcs from 3.19, client certificates to upstreams, system CA trust, and fixing services that start failing after the upgrade.
Protecting credentials in the configuration store: sensitive field encryption on by default from 3.10, the keyring, which plugin fields are covered, secret references to Vault or cloud secret managers, and key rotation.
Adding web application firewall inspection at the gateway with chaitin-waf: block and monitor modes, timeouts and body limits, passing the real client IP, response inspection and rolling out in monitor mode first.
Blocking unwanted clients before authentication: ip-restriction allow and deny lists, ua-restriction with mutually exclusive lists since 3.5, referer-restriction and uri-blocker, and the real client IP behind load balancers.
Bounding memory use and abuse at the gateway: per-plugin body size limits from 3.18, client-control, post argument limits, logger backlogs and how limits interact with large uploads and streaming APIs.
Getting the client address and scheme right behind load balancers: the real-ip plugin, X-Forwarded header sanitization in 3.18, trusted proxies, and why spoofed headers break rate limits and IP restrictions.
Serving many domains from one gateway: SSL objects and SNI matching, wildcard certificates, client CAs, OCSP stapling, schema changes in 3.7, certificates stored as secrets and automating renewals.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.