title: Microservices internal communication
body: <p>I'm learning APIs with microservies architect. Here is small description about the setup  </p>
  
  <ul>
  <li>I've two microservice applications and API gateway</li>
  <li>All the applications including API gateway is nodeJs - express app.</li>
  <li>Auth logic - JWT, handled on API gateway</li>
  <li>Pass each incoming API gateway request to each of the microservice applications using http-proxy.</li>
  <li>Also passes the user info as proxy header. </li>
  </ul>
  
  <p><strong>Client request flow:</strong><br>
  Client requesting API1 from microservice1 with JWT token which will be authenticated at API gateway and then information will be served from microservice1. which is fine.<br>
  But I've one private API2 which should not be allowed from client side. Only internal applications can use it, but it should be callable upon another request from the client side.  </p>
  
  <p>eg.  </p>
  
  <pre><code>client request -&gt; /API/Gateway1 (has JWT)
  /API/Gateway1 -&gt; API1 (has valid user)
  API1 -&gt; /API/Gateway2 (has valid user)
  /API/Gateway2 -&gt; API2 (has valid user)
  </code></pre>
  
  <p><strong>Question:</strong><br>
  How can I protect API2 from the client side, what if client fakes the valid user header.</p>