Is it worth it to validate JWT on each microservice if validation occurs on the API Gateway?

Question

JSON Web Token

Good day to all. The question is simple, from a security point of view, is it worth it to validate JWT on each microservice, provided that JWT is initially validated on API Gateway before being proxyed to the desired microservice? Or is it an unnecessary load and time spent processing the request? Or, from a security point of view, it makes sense to protect each route on microservices?

Answer 1

In the general scheme, it depends on whether you guarantee the security of traffic between the API gateway and the backend. If you are talking about AWS API gateway, then you do not need to transfer the token further at all, but the necessary information is enough