Api Gateway medium
You have 10 API Gateway instances behind a Global Load Balancer. You want to enforce a strict limit of 1,000 requests per minute per user. Why is storing the request counters in the Gateway's local memory insufficient?
- A Local RAM is too slow for the high-concurrency requirement of rate limiting.
- B The Load Balancer usually strips the IP address, so the Gateway cannot identify the user.
- C State Fragmentation: A user's traffic is distributed across all 10 Gateways. Without a centralized store (like Redis), the user could potentially send 10,000 requests per minute by exploiting the isolated counters.
- D Gateway instances are purged from memory every 60 seconds by default to save costs.
Answer: C. State Fragmentation: A user's traffic is distributed across all 10 Gateways. Without a centralized store (like Redis), the user could potentially send 10,000 requests per minute by exploiting the isolated counters.
Distributed systems require a 'Source of Truth' for shared state. Using a fast, in-memory store like Redis or Memcached allows all Gateway instances to read/write the same counter atomically, ensuring that the 1,000-request limit is enforced globally, regardless of which instance receives the request.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- Your Gateway communicates with backends via HTTP/1.1 connections. A slow backend service causes 'Head-of-Line Blocking'. How does switching to HTTP/2 as the Gateway-to-Backend transport mitigate this?
- What is the primary architectural role of an API Gateway in a microservices environment?
- Why is 'Stateless Token Validation' (e.g., using JWTs) significantly more scalable at the Gateway level than 'Stateful Validation' (e.g., using Opaque/Reference Tokens)?
- Your Gateway is configured to cache any URL ending in `.css` or `.jpg`. An attacker tricks a victim into visiting `https://api.com/v1/profile/info/style.css`. How can this lead to an 'Account Takeover'?
- An API is receiving a sudden surge of 10,000 requests per second from a single IP address. How does an API Gateway preserve the stability of the backend services?
- How can an API Gateway help prevent 'Double Charging' in a payment system when a mobile client retries a failed request due to a poor connection?