title: Don't allow direct calls to Microservices. Only allow through API Gateway
body: <p>Maybe this is a strange question (I'm new with Microservices). But I'm looking for some info on how proceed with this. Does not need to be Spring specific, but that's the framework I'm using at the moment.</p>
  
  <p>Example:
  Lets say we have two Microservices</p>
  
  <p>a) <a href="http://myurlfortesting.com:8085/api/rest/serviceone" rel="noreferrer">http://myurlfortesting.com:8085/api/rest/serviceone</a></p>
  
  <p>b) <a href="http://myurlfortesting.com:8090/api/rest/servicetwo" rel="noreferrer">http://myurlfortesting.com:8090/api/rest/servicetwo</a></p>
  
  <p>and we have setup Spring Zuul (acting as the API Gateway) with the following rules that forward the incoming calls:</p>
  
  <p>/rest/one -> <a href="http://myurlfortesting.com:8085/api/rest/serviceone" rel="noreferrer">http://myurlfortesting.com:8085/api/rest/serviceone</a></p>
  
  <p>/rest/two -> <a href="http://myurlfortesting.com:8090/api/rest/servicetwo" rel="noreferrer">http://myurlfortesting.com:8090/api/rest/servicetwo</a></p>
  
  <p>The question...
  Is there a way to stop users from directly accessing the services mentioned in A and B (only allow the ones that come through the API Gateway)?</p>
  
  <p>Can this be done with Springs Zuul (Acting as a API Gateway) by setting up some extra filters or do we set it up in Microservices endpoints?</p>
  
  <p>Would even like to know if there is a way to not even processing the direct calls on the Microservices endpoints that don't come via the API Gateway.</p>
  
  <p>Maybe this is solved with server specific rules and has nothing to do with Spring? </p>
  
  <p>Many thanks,</p>
  
  <p>/D</p>