Bird
Raised Fist0

API Gateway Pattern - Auth, Rate Limiting, Routing, Transformation

HLDmediumInterview freq: high
Choose your preparation mode4 modes available
ArchitectureTraceChallenge
▶
Request Trace
Step 1/8
API Gateway Load Balancer

Receives client HTTP request and forwards it

Load balancer selects an API Gateway Node based on load

Protocol:HTTP/HTTPS
BeforeClient request arrives at load balancer
AfterRequest forwarded to selected API Gateway Node
API Gateway Nodes

Extracts auth token and calls Auth Service

Validates token to authenticate client

Protocol:HTTP/HTTPS
BeforeRequest received with auth token
AfterClient authenticated or rejected
Auth Service

Validates token and returns auth result

Checks token validity and user permissions

Protocol:HTTP/HTTPS
BeforeReceived token validation request
AfterReturns success or failure to API Gateway Node
API Gateway Nodes

Queries Redis Cluster for rate limiting counters

Checks if client exceeded allowed request rate

Protocol:Redis GET/SET
BeforeClient authenticated, rate limit counters unknown
AfterRate limit status known; request allowed or throttled
Redis Cluster

Returns current rate limit counters and updates them

Increments request count for client key

Protocol:Redis GET/SET
BeforeRate limit counters stored for client
AfterCounters updated with current request
API Gateway Nodes

Transforms and routes request to backend service

Modifies headers and payload as needed

Protocol:HTTP/HTTPS
BeforeRequest authenticated and rate limited
AfterRequest forwarded to backend with transformations
API Gateway Nodes

Sends telemetry data asynchronously

Logs request metrics and events

Protocol:HTTP/HTTPS
BeforeRequest processing completed
AfterMetrics sent to Metrics & Logging Pipeline
Metrics & Logging Pipeline

Receives and processes telemetry data

Aggregates logs and metrics for monitoring

Protocol:HTTP/HTTPS
BeforeTelemetry data in transit
AfterMetrics stored and ready for analysis
🏗️
Architecture Diagram
Architecture Diagram
          ┌───────────────────────────────┐
          │ API Gateway Load Balancer     │
          └───────────────┬───────────────┘
                          │ HTTP/HTTPS
                          ▼
          ┌───────────────────────────────┐
          │    API Gateway Nodes          │
          │ (Auth, Rate Limiting, Routing │
          │  & Transformation)            │
          └───────┬─────────┬─────────────┘
                  │         │
        ┌─────────▼─┐   ┌───▼───────────┐
        │ Auth      │   │ Redis Cluster │
        │ Service   │   │ (Rate Limit)  │
        └───────────┘   └───────────────┘
                  │         ▲
                  │         │ Redis GET/SET
                  └─────────┘
                          │
                          ▼
          ┌───────────────────────────────┐
          │ Metrics & Logging Pipeline    │
          └───────────────────────────────┘
Design Rationale

This API Gateway architecture handles client requests by first passing them through a load balancer which distributes traffic to multiple API Gateway Nodes. Each node performs authentication by calling the Auth Service to validate tokens. After successful authentication, the node queries the Redis Cluster to enforce rate limiting by checking and updating counters. The gateway then applies routing and transformation logic before forwarding the request to backend services. Meanwhile, telemetry data is sent asynchronously to the Metrics & Logging Pipeline for monitoring. This design centralizes cross-cutting concerns like auth and rate limiting, improving scalability and observability.

Primary Focus

✓

Practice

(1/5)
1. In the blob store request flow, at Step 4 the Metadata Service validates the object's metadata and checks for existing versions. What happens if the metadata validation fails at this step?
easy
A. The request is rejected and the client receives an error before any data is stored
B. The system retries metadata validation asynchronously and proceeds with write
C. The object is immediately written to the storage nodes without metadata update
D. The object is stored but marked as invalid for later cleanup

Solution

  1. Step 1: Trace Metadata Service validation at Step 4

    The Metadata Service performs synchronous validation; failure causes immediate rejection to prevent invalid data.

  2. Step 2: Eliminate other options

    Writing without metadata update breaks consistency, async retry delays error feedback, and storing invalid data risks corruption.

  3. Final Answer:

    Option A -> Option A

  4. Quick Check:

    Metadata validation failure causes immediate client error [check]
Hint: Metadata validation failure rejects request immediately [check]
Common Mistakes:
2. If the Bloom filter component is removed from a Cassandra-like system, what exact failure occurs during a read request for a non-existent key?
medium
A. The system returns stale data from cache without checking disk
B. Every read request for a non-existent key triggers a costly disk lookup, increasing latency and load
C. Writes block until the Bloom filter is rebuilt, causing backpressure
D. The system incorrectly returns key-not-found errors for existing keys due to missing filters

Solution

  1. Step 1: Understand Bloom filter role in reads

    Bloom filters prevent unnecessary disk reads for non-existent keys but do not affect correctness of existing keys.

  2. Step 2: Trace failure without Bloom filters

    Without Bloom filters, reads for non-existent keys cause disk lookups, increasing latency but do not cause incorrect key-not-found errors for existing keys; however, missing Bloom filters can cause stale data to be returned if caching is mismanaged.

  3. Final Answer:

    Option D -> Option D

  4. Quick Check:

    Removing Bloom filters risks incorrect key-not-found errors due to stale cache [check]
Hint: No Bloom filter -> stale cache causes wrong misses [check]
Common Mistakes:
3. For ensuring strong consistency in a distributed digital wallet system, which architecture is better suited given the need to support high throughput and fault tolerance?
medium
A. Use a distributed event sourcing architecture with Kafka as the event log and materialized views for queries
B. Use a NoSQL database with eventual consistency and background reconciliation jobs
C. Use a single centralized relational database with ACID transactions for all wallet operations
D. Use a microservices architecture with synchronous REST calls between services for each transaction

Solution

  1. Step 1: Analyze consistency and throughput requirements

    Strong consistency with high throughput and fault tolerance requires decoupling writes and reads with durable event logs.

  2. Step 2: Evaluate architectures

    Centralized DB (A) limits throughput and is a single point of failure; NoSQL eventual consistency (C) violates strong consistency; synchronous REST calls (D) increase latency and reduce fault tolerance. Event sourcing with Kafka (B) provides durable, ordered events and scalable materialized views.

  3. Final Answer:

    Option A -> Option A

  4. Quick Check:

    Event sourcing with Kafka -> strong consistency and scalability [check]
Hint: Event sourcing with Kafka balances consistency and scale [OK]
Common Mistakes:
4. If the reverse proxy responsible for SSL termination crashes, what exactly breaks in the request flow?
medium
A. Clients can still connect directly to backend servers without interruption
B. Clients' SSL handshakes fail, so connections never reach backend servers
C. Backend servers receive unencrypted traffic, exposing internal data
D. The reverse proxy forwards requests without decrypting, causing backend errors

Solution

  1. Step 1: Understand reverse proxy SSL termination failure

    If the reverse proxy crashes, SSL termination stops, so backend servers receive unencrypted traffic if clients connect directly or fallback occurs.

  2. Step 2: Eliminate other options

    Clients cannot connect directly if proxy is mandatory; SSL handshake fails only if proxy blocks connection; proxy can't forward encrypted requests without decrypting if crashed.

  3. Final Answer:

    Option C -> Option C

  4. Quick Check:

    Reverse proxy crash exposes backend to unencrypted traffic [check]
Hint: Reverse proxy crash exposes backend to unencrypted traffic [check]
Common Mistakes:
5. At 10x scale, which component is most likely to fail first due to stateful connection limits, and why?
hard
A. The chat servers, because WebSocket connections are stateful and cannot be resharded easily
B. The message queue, because partition count limits throughput
C. The database cluster, because query volume exceeds CPU capacity
D. The load balancer, because it cannot distribute traffic evenly at high scale

Solution

  1. Step 1: Identify stateful bottleneck

    Chat servers maintain WebSocket connections bound to server memory, limiting horizontal scaling and resharding.

  2. Step 2: Compare other components

    Database (A) can be scaled with sharding; message queue (C) partitions can be increased; load balancer (D) scales horizontally.

  3. Step 3: Explain failure mechanism

    WebSocket statefulness causes connection limits per server, leading to failure under 10x load.

  4. Final Answer:

    Option A -> Option A

  5. Quick Check:

    Stateful WebSocket limits -> chat servers fail first at scale [check]
Hint: Stateful WebSockets limit scaling; stateless scale easier [check]
Common Mistakes:
Recommended

Ready to prove it?

Pass the test and this pattern moves unknown strong while earning +1 Grip toward your certificate.

10 questions~5 mineasy hard