why is client certificate attachment a property of inbound flow rather than backend flow?

Question

I am using the below policy to attach client certificate for authenticating with backend (origin)

It all works great.

But this policy is only applicable in inbound section only and not in backend.
Logically it makes sense to have this policy applicable in backend section and not in inbound section, because it is authentication mechanism with backend ie on the outbound traffic from gateway to backend(origin)
Trying to understand the logic why this policy is applicable in inbound and not in backend?

Accepted Answer

@Martin Kallukalam Thanks for reaching out. The policy you’re using is indeed applied in the inbound section of the API Management policy.

Inbound section: This is where the request first hits the API Management service. At this point, the service can manipulate the request before it gets sent to the backend. This is why the policy is applied here - it’s at this stage that the certificate is attached to the request.

Backend section: This is where the request is forwarded to the backend service. At this point, the request has already been prepared and is ready to be sent. The backend service then uses the certificate for authentication.

So, while it might seem more logical for the policy to be in the backend section, it’s actually necessary for it to be in the inbound section so that the certificate can be attached to the request before it’s sent to the backend.

I hope this helps clarify things! do let me know incase of further queries, I would be happy to assist you.

Share via

why is client certificate attachment a property of inbound flow rather than backend flow?

0 additional answers