Api Gateway hard
Why is the 'Sliding Window Log' algorithm considered the most accurate (but memory-intensive) for strict rate limiting at the API Gateway?
- A Because it uses an advanced machine learning model to predict the user's next request time.
- B It stores a timestamp for *every* individual request in the window, allowing for precise calculation of the request rate at any given millisecond, eliminating 'Fixed Window' boundary spikes.
- C It is the only algorithm that can work across different time zones simultaneously.
- D It automatically adjusts the user's limit based on their bank account balance.
Answer: B. It stores a timestamp for *every* individual request in the window, allowing for precise calculation of the request rate at any given millisecond, eliminating 'Fixed Window' boundary spikes.
Fixed Window (e.g., 10 reqs/min) has a flaw: a user can send 10 reqs at 11:59 and 10 more at 12:00, effectively doubling their limit in 2 seconds. Sliding Window Log tracks every single request time, so at 12:00:01, it looks back exactly 60 seconds and sees the 20 requests, correctly blocking the abuser.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- Your Gateway communicates with backends via HTTP/1.1 connections. A slow backend service causes 'Head-of-Line Blocking'. How does switching to HTTP/2 as the Gateway-to-Backend transport mitigate this?
- What is the primary architectural role of an API Gateway in a microservices environment?
- Why is 'Stateless Token Validation' (e.g., using JWTs) significantly more scalable at the Gateway level than 'Stateful Validation' (e.g., using Opaque/Reference Tokens)?
- Your Gateway is configured to cache any URL ending in `.css` or `.jpg`. An attacker tricks a victim into visiting `https://api.com/v1/profile/info/style.css`. How can this lead to an 'Account Takeover'?
- An API is receiving a sudden surge of 10,000 requests per second from a single IP address. How does an API Gateway preserve the stability of the backend services?
- How can an API Gateway help prevent 'Double Charging' in a payment system when a mobile client retries a failed request due to a poor connection?