Every inter-service request carries three headers:

Signed payload format:

{METHOD}\n{PATH}\n{TIMESTAMP}\n{BODY}

Path is normalized with a leading /. Body is raw JSON or an empty string. Query parameters are not signed.

Verifies X-Signature and X-Timestamp. Use on routes that accept proxied calls from a gateway:

use Jurager\Microservice\Http\Middleware\TrustGateway;

Route::middleware(TrustGateway::class)->group(function () {
    Route::get('/api/products', [ProductController::class, 'index']);
});

Returns 401 if the signature or timestamp is missing or invalid.

Extends TrustGateway and additionally requires X-Service-Name. Used internally to protect the GET /microservice/manifest endpoint:

use Jurager\Microservice\Http\Middleware\TrustService;

Route::middleware(TrustService::class)->group(function () {
    Route::get('/microservice/manifest', [ManifestController::class, 'show']);
});

The Idempotency middleware deduplicates mutating requests using X-Request-Id:

use Jurager\Microservice\Http\Middleware\Idempotency;

Route::middleware(Idempotency::class)->group(function () {
    Route::post('/api/orders', OrderController::class);
});

Rules:

• Applied to POST, PUT, PATCH, DELETE only.
• Skipped silently when X-Request-Id is absent.
• X-Request-Id must be a valid UUID v4 — invalid values return 400.
• Duplicate in-flight requests return 409.
• Only 2xx responses are cached. Cached responses include X-Idempotency-Cache-Hit: true.
• State is stored in Redis using microservice.redis.connection.