Api Gateway medium
You have a Desktop Web App (high bandwidth) and a Mobile App (low bandwidth/high latency). Why might you implement the 'Backend for Frontend' (BFF) pattern instead of a single General Purpose API Gateway?
- A To allow the Mobile App to access the production database directly, bypassing the service layer for performance.
- B To create tailored entry points: The Mobile Gateway can perform heavy data filtering and field stripping to minimize payload size, while the Web Gateway provides rich, verbose data sets.
- C To ensure that the mobile application uses hardware-based encryption while the web app uses software-based SSL.
- D To strictly separate the development teams so they never have to share the same Git repository.
Answer: B. To create tailored entry points: The Mobile Gateway can perform heavy data filtering and field stripping to minimize payload size, while the Web Gateway provides rich, verbose data sets.
A 'One Size Fits All' API often leads to 'Over-fetching' (sending more data than needed) on mobile devices or 'Under-fetching' on desktop. The BFF pattern decouples the frontend requirements from the backend service evolution, allowing each client type to have an optimized interface that minimizes network overhead and improves responsiveness.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- Your Gateway communicates with backends via HTTP/1.1 connections. A slow backend service causes 'Head-of-Line Blocking'. How does switching to HTTP/2 as the Gateway-to-Backend transport mitigate this?
- What is the primary architectural role of an API Gateway in a microservices environment?
- Why is 'Stateless Token Validation' (e.g., using JWTs) significantly more scalable at the Gateway level than 'Stateful Validation' (e.g., using Opaque/Reference Tokens)?
- Your Gateway is configured to cache any URL ending in `.css` or `.jpg`. An attacker tricks a victim into visiting `https://api.com/v1/profile/info/style.css`. How can this lead to an 'Account Takeover'?
- An API is receiving a sudden surge of 10,000 requests per second from a single IP address. How does an API Gateway preserve the stability of the backend services?
- How can an API Gateway help prevent 'Double Charging' in a payment system when a mobile client retries a failed request due to a poor connection?