input and authentication validation in microservices and api-gateway architecture

in short, where the input validation and authentication validation should be executed? In api-gateway and each microservice? only in api-gateway? only in each microservice?

Maybe part of it in api-gateway and part in each?

Thanks for answer!

via Tamir Shasha