Api Gateway medium
Why is 'Stateless Token Validation' (e.g., using JWTs) significantly more scalable at the Gateway level than 'Stateful Validation' (e.g., using Opaque/Reference Tokens)?
- A JWTs are mathematically guaranteed to never expire, so they never need to be re-checked.
- B The Gateway can verify the JWT's signature locally using a public key, eliminating a blocking network call to an external Authentication Service or Database.
- C JWTs use a special form of quantum encryption that makes them 10x smaller than opaque tokens.
- D The Gateway stores the entire user database in its L1 cache for instant JWT lookup.
Answer: B. The Gateway can verify the JWT's signature locally using a public key, eliminating a blocking network call to an external Authentication Service or Database.
Opaque tokens are just pointers (e.g., a random UUID). To validate them, the Gateway MUST call a central session database. In high-traffic systems, this database becomes a massive bottleneck. JWTs carry their own data and are signed; the Gateway just needs to perform a CPU-bound cryptographic check to prove the token is valid and hasn't been tampered with.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- Your Gateway communicates with backends via HTTP/1.1 connections. A slow backend service causes 'Head-of-Line Blocking'. How does switching to HTTP/2 as the Gateway-to-Backend transport mitigate this?
- What is the primary architectural role of an API Gateway in a microservices environment?
- Your Gateway is configured to cache any URL ending in `.css` or `.jpg`. An attacker tricks a victim into visiting `https://api.com/v1/profile/info/style.css`. How can this lead to an 'Account Takeover'?
- An API is receiving a sudden surge of 10,000 requests per second from a single IP address. How does an API Gateway preserve the stability of the backend services?
- How can an API Gateway help prevent 'Double Charging' in a payment system when a mobile client retries a failed request due to a poor connection?
- What is the primary operational benefit of performing 'SSL Termination' at the API Gateway?