Api Gateway medium
Aside from the extra network 'hop', what are the primary technical factors that contribute to the latency overhead of an API Gateway?
- A The time spent reading and writing logs to the Gateway's internal physical hard drive.
- B Serialization/Deserialization overhead (JSON parsing) and the cryptographic work required for SSL/TLS termination and JWT validation.
- C The time taken to automatically back up the Gateway's configuration to the cloud every minute.
- D The extra power consumption of the servers, which slows down the CPU frequency.
Answer: B. Serialization/Deserialization overhead (JSON parsing) and the cryptographic work required for SSL/TLS termination and JWT validation.
An API Gateway isn't just a blind pass-through. It has to parse the incoming headers, verify signatures (CPU heavy), potentially parse the JSON body for routing or validation, and then re-serialize the request for the backend. In ultra-low-latency environments, this 'Middleware Tax' can be 5-10ms, which must be carefully managed.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- Your Gateway communicates with backends via HTTP/1.1 connections. A slow backend service causes 'Head-of-Line Blocking'. How does switching to HTTP/2 as the Gateway-to-Backend transport mitigate this?
- What is the primary architectural role of an API Gateway in a microservices environment?
- Why is 'Stateless Token Validation' (e.g., using JWTs) significantly more scalable at the Gateway level than 'Stateful Validation' (e.g., using Opaque/Reference Tokens)?
- Your Gateway is configured to cache any URL ending in `.css` or `.jpg`. An attacker tricks a victim into visiting `https://api.com/v1/profile/info/style.css`. How can this lead to an 'Account Takeover'?
- An API is receiving a sudden surge of 10,000 requests per second from a single IP address. How does an API Gateway preserve the stability of the backend services?
- How can an API Gateway help prevent 'Double Charging' in a payment system when a mobile client retries a failed request due to a poor connection?