gRPC proxying in Nginx - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

gRPC Proxying Basic Configuration Output

What will be the output status code when NGINX proxies a gRPC request to a backend that is up and running with this configuration?

Nginx

server {
    listen 50051 http2;
    location / {
        grpc_pass grpc://backend:50052;
    }
}

A HTTP/2 200 OK

B HTTP/1.1 500 Internal Server Error

C HTTP/2 404 Not Found

D HTTP/1.1 502 Bad Gateway

💡 Hint

Check if the grpc_pass directive points to a valid backend and if HTTP/2 is enabled.

When NGINX proxies a gRPC request correctly to a healthy backend, it returns HTTP/2 200 OK status.

❓ Troubleshoot

intermediate

Identifying the Cause of gRPC 502 Bad Gateway

Given this NGINX snippet, what is the most likely cause of receiving a 502 Bad Gateway error when proxying gRPC requests?

Nginx

server {
    listen 443 ssl http2;
    ssl_certificate /etc/ssl/certs/server.crt;
    ssl_certificate_key /etc/ssl/private/server.key;

    location / {
        grpc_pass grpc://127.0.0.1:50051;
    }
}

A NGINX does not support grpc_pass on port 443

B Missing proxy_set_header directives for gRPC metadata

C SSL certificates are invalid causing handshake failure

D The backend gRPC server is not running or unreachable on 127.0.0.1:50051

💡 Hint

502 Bad Gateway usually means NGINX cannot connect to the backend service.

A 502 error indicates NGINX could not reach the backend gRPC server at 127.0.0.1:50051. The SSL config is for client connections, not backend connectivity.

❓ Configuration

advanced

Correct gRPC Timeout Configuration

Which NGINX configuration snippet correctly sets a 10-second timeout for gRPC proxying to avoid hanging requests?

A

location / {
    grpc_pass grpc://backend:50051;
    grpc_read_timeout 10s;
}

B

location / {
    grpc_pass grpc://backend:50051;
    proxy_read_timeout 10s;
}

C

location / {
    grpc_pass grpc://backend:50051;
    grpc_send_timeout 10s;
}

D

location / {
    grpc_pass grpc://backend:50051;
    proxy_send_timeout 10s;
}

💡 Hint

Use the directive specific to gRPC read timeout, not generic proxy timeouts.

grpc_read_timeout sets the timeout for reading a response from the gRPC backend. proxy_read_timeout is for HTTP proxying, not gRPC.

🔀 Workflow

advanced

Order of Steps to Enable gRPC Proxying in NGINX

Arrange the steps in the correct order to enable gRPC proxying in NGINX for a new service.

A 1,3,2,4

B 2,1,3,4

C 1,2,3,4

D 2,3,1,4

💡 Hint

Think about starting backend first, then configuring proxy, then applying config, then testing.

You must have the backend running before configuring NGINX to proxy it. Then reload NGINX and test the connection.

✅ Best Practice

expert

Best Practice for Handling gRPC Errors in NGINX Proxy

Which configuration snippet correctly handles gRPC backend errors by returning a custom error message to clients?

A

error_page 502 = /grpc_fallback;
location = /grpc_fallback {
    internal;
    default_type application/grpc;
    add_header grpc-status 14;
    add_header grpc-message "Unavailable backend";
    return 204;
}

B

error_page 502 = /grpc_fallback;
location = /grpc_fallback {
    internal;
    default_type application/grpc;
    add_header grpc-status 14;
    add_header grpc-message "Unavailable backend";
    return 200;
}

C

error_page 502 = /grpc_fallback;
location = /grpc_fallback {
    internal;
    default_type application/grpc;
    add_header grpc-status 14;
    add_header grpc-message "Unavailable backend";
    return 503;
}

D

error_page 502 = /grpc_fallback;
location = /grpc_fallback {
    internal;
    default_type application/grpc;
    add_header grpc-status 14;
    add_header grpc-message "Unavailable backend";
    return 500;
}

💡 Hint

gRPC error responses use HTTP/2 200 with grpc-status trailer (14 = UNAVAILABLE) for proper client handling.

gRPC responses including errors use HTTP/2 200 with grpc-status trailer set to 14 (UNAVAILABLE). Returning 503 or other 5xx makes it an HTTP transport error, not a proper gRPC status.

Practice

1. What directive in nginx is used to forward gRPC requests to a backend server?

easy

A. fastcgi_pass

B. proxy_pass

C. grpc_pass

D. uwsgi_pass

Solution

1. Step 1: Understand gRPC proxying in nginx

   nginx uses a special directive to forward gRPC calls to backend servers.

2. Step 2: Identify the correct directive

   The directive grpc_pass is specifically designed for gRPC proxying, unlike proxy_pass which is for HTTP, or others for different protocols.

3. Final Answer:

   grpc_pass -> Option C

4. Quick Check:

   gRPC forwarding uses grpc_pass [OK]

Hint: gRPC proxying always uses grpc_pass directive [OK]

Common Mistakes:

• Confusing grpc_pass with proxy_pass
• Using fastcgi_pass for gRPC
• Not enabling HTTP/2 for gRPC

2. Which of the following is the correct syntax to proxy gRPC traffic to a backend at 127.0.0.1:50051 in nginx?

easy

A. grpc_pass grpc://127.0.0.1:50051;

B. grpc_pass http://127.0.0.1:50051;

C. proxy_pass grpc://127.0.0.1:50051;

D. proxy_pass http://127.0.0.1:50051;

Solution

1. Step 1: Recognize correct protocol prefix for grpc_pass

   The grpc_pass directive requires the backend address to start with grpc:// or grpcs:// for secure connections.

2. Step 2: Match syntax with correct directive and protocol

   grpc_pass grpc://127.0.0.1:50051; uses grpc_pass grpc://127.0.0.1:50051; which is the correct syntax. Options A and D use http:// which is incorrect for gRPC. proxy_pass grpc://127.0.0.1:50051; uses proxy_pass which is not for gRPC.

3. Final Answer:

   grpc_pass grpc://127.0.0.1:50051; -> Option A

4. Quick Check:

   grpc_pass + grpc:// = correct syntax [OK]

Hint: Use grpc_pass with grpc:// for gRPC backend URLs [OK]

Common Mistakes:

• Using proxy_pass instead of grpc_pass
• Using http:// instead of grpc://
• Omitting the semicolon at the end

3. Given this nginx snippet inside a server block:

location /grpc {
  grpc_pass grpc://backend:9000;
  error_page 502 = /error502grpc;
}

What happens if the backend server at backend:9000 is down?

medium

A. nginx silently drops the request without response

B. nginx returns the custom error page at /error502grpc

C. nginx returns a default 404 Not Found error

D. nginx retries the request indefinitely

Solution

1. Step 1: Understand error_page directive usage

   The error_page 502 = /error502grpc; tells nginx to serve the URI /error502grpc when a 502 Bad Gateway error occurs.

2. Step 2: Recognize backend down causes 502 error

   If the backend is down, nginx cannot connect and returns a 502 error, triggering the custom error page.

3. Final Answer:

   nginx returns the custom error page at /error502grpc -> Option B

4. Quick Check:

   502 error triggers custom error_page [OK]

Hint: 502 errors can be customized with error_page directive [OK]

Common Mistakes:

• Assuming 404 is returned for backend failure
• Thinking nginx retries endlessly
• Ignoring error_page directive effect

4. You configured nginx to proxy gRPC with:

grpc_pass grpc://backend:50051;

But clients report connection errors. Which nginx configuration is missing?

medium

A. fastcgi_pass backend;

B. listen 80;

C. proxy_http_version 1.1;

D. listen 443 ssl http2;

Solution

1. Step 1: Identify protocol requirements for gRPC

   gRPC requires HTTP/2 support, so nginx must listen with http2 enabled.

2. Step 2: Check the listen directive

   listen 443 ssl http2; includes listen 443 ssl http2; which enables HTTP/2 over TLS, necessary for secure gRPC connections. Options B and C do not enable HTTP/2, and A is unrelated.

3. Final Answer:

   listen 443 ssl http2; -> Option D

4. Quick Check:

   HTTP/2 is required for gRPC proxying [OK]

Hint: Enable HTTP/2 with listen directive for gRPC [OK]

Common Mistakes:

• Not enabling http2 in listen directive
• Using proxy_http_version 1.1 instead of http2
• Confusing fastcgi_pass with grpc_pass

5. You want nginx to proxy gRPC securely to a backend using TLS on port 50051. Which configuration snippet correctly sets this up?

hard

A. grpc_pass grpcs://backend:50051; listen 443 ssl http2;

B. grpc_pass grpc://backend:50051;

C. proxy_pass grpcs://backend:50051; listen 443 ssl http2;

D. grpc_pass grpc://backend:50051; listen 80;

Solution

1. Step 1: Use grpcs:// for secure gRPC backend

   To proxy gRPC over TLS, the backend URL must start with grpcs://.

2. Step 2: Enable SSL and HTTP/2 on nginx listen

   Listening on port 443 with ssl and http2 is required for secure gRPC proxying.

3. Step 3: Verify correct directive usage

   Use grpc_pass (not proxy_pass) with the secure URL and proper listen directive.

4. Final Answer:

   grpc_pass grpcs://backend:50051; listen 443 ssl http2; -> Option A

5. Quick Check:

   Secure gRPC needs grpcs:// and ssl http2 [OK]

Hint: Use grpcs:// and listen 443 ssl http2 for secure gRPC [OK]

Common Mistakes:

• Using grpc:// instead of grpcs:// for TLS
• Not enabling ssl and http2 on listen
• Using proxy_pass instead of grpc_pass