I have a requirement to add security between service to API communication. The current implementation is client certificates. The client gets a certificate and just sends it in a cookie to the API. API does zero verification of the certificate. It pretty much is "just there" in the cookie.
The reason is they are concerned with additional overhead in any server validation as they need calls to be instantaneous. 3 seconds is too long. Think stock trades. Calls need to be real-time and instant.
So would implementing something like an OAuth JWT token and validating it on the API server add additional overhead that will slow down a transaction?
What about an API gateway? Does that also introduce additional overhead?
I'm looking for the fastest available solution that will not increase processing time but I can also validate incoming requests on the server.