Spring Cloud Gateway

Keep the gateway an edge adapter. Do not move domain workflows into filters.

Compatibility first

• Select the Spring Cloud release train compatible with the exact Boot 3 minor.
• Import the Spring Cloud BOM and omit individual Spring Cloud dependency versions.
• Prefer the reactive gateway unless the project deliberately uses the MVC variant.

Route rules

• Use stable route IDs and explicit predicates.
• Strip untrusted forwarding, identity, and internal headers at the edge.
• Add correlation headers only after removing client-supplied values.
• Keep path rewriting and host changes visible in route configuration.
• Set connect and response timeouts globally, with narrow route overrides.

Security and resilience