“Our developers actually prefer the API gateway method,” he says ... “We tried some legacy ways but a web application firewall doesn’t work, though it gives you a little bit of protection ...