First, a little context on our setup:
In our setup, we have a Google App Engine project with a reverse proxy in the default service. It acts as an API gateway to all other microservices in the same project. This was recommended to us by Google engineers.
All requests from clients to these microservices should be routed through this gateway, so we need the underlying services to respect the X-Forwarded-* headers when building new URLs. This causes a security problem though: a malicious user could forge the headers to make our application call endpoints in their own domain.
To protect against this, the underlying services must be isolated from the external world. They must only accept requests that come from the same project (which is, the gateway and other microservices).
In App Engine Standard there's a way to tell App Engine to include a X-Appengine-Inbound-Appid header that validates the project, but we couldn't find anything similar to this in App Engine Flexible. In particular, the migration guide says nothing about asserting request identity.
How do we assert that a request came from the same App Engine project?
Is this possible at all in the flexible environment? We'd like to avoid implementing a shared secret (that could leak), or a mechanism where the services have to always check with the gateway if the request came from them :/
Right now we're having to validate in the services themselves that the X-Forwarded-* headers adhere to its expected format, which beats the whole purpose of using the headers in the first place.