Api Gateway easy
Why is 'Authentication Offloading' to the API Gateway considered an architectural best practice for microservices?
- A It centralizes security logic, ensuring that individual microservices don't have to redundantly implement code for verifying JWTs or session tokens.
- B It allows the Gateway to bypass password verification to make the login process faster.
- C It ensures that microservices are only accessible via physical cables in the datacenter.
- D It automatically converts all User IDs into a 128-bit hash to prevent database leaks.
Answer: A. It centralizes security logic, ensuring that individual microservices don't have to redundantly implement code for verifying JWTs or session tokens.
Authentication is a 'Cross-Cutting Concern'. Instead of 50 different microservices all writing code to check if a user is logged in, the Gateway checks the 'ID' at the front door. If the user is authenticated, the Gateway forwards the request with validated user context to the backends.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- Your Gateway communicates with backends via HTTP/1.1 connections. A slow backend service causes 'Head-of-Line Blocking'. How does switching to HTTP/2 as the Gateway-to-Backend transport mitigate this?
- What is the primary architectural role of an API Gateway in a microservices environment?
- Why is 'Stateless Token Validation' (e.g., using JWTs) significantly more scalable at the Gateway level than 'Stateful Validation' (e.g., using Opaque/Reference Tokens)?
- Your Gateway is configured to cache any URL ending in `.css` or `.jpg`. An attacker tricks a victim into visiting `https://api.com/v1/profile/info/style.css`. How can this lead to an 'Account Takeover'?
- An API is receiving a sudden surge of 10,000 requests per second from a single IP address. How does an API Gateway preserve the stability of the backend services?
- How can an API Gateway help prevent 'Double Charging' in a payment system when a mobile client retries a failed request due to a poor connection?