Api Gateway hard
You have multi-region API Gateways (US and EU). A US user fails over to the EU region during an outage but receives `401 Unauthorized` for their valid token. What architectural component was likely neglected?
- A Global Database Locking: You must lock the user's account in all regions whenever they are logged in.
- B The 'Global Statelessness' of the validation mechanism: The Gateway's JWT signing keys (or JWKS endpoints) were not globally synchronized across regions, so the EU Gateway couldn't 'trust' the US token's signature.
- C Regional Latency: The EU Gateway was too slow to respond, causing the browser to assume the token was invalid.
- D The EU Gateway requires tokens to be prefixed with the `EU#` string to be valid.
Answer: B. The 'Global Statelessness' of the validation mechanism: The Gateway's JWT signing keys (or JWKS endpoints) were not globally synchronized across regions, so the EU Gateway couldn't 'trust' the US token's signature.
High-availability at the edge requires global state synchronization for the 'Security' layer. If you use asymmetric keys (RS256), both regions must have the same public keys in their JWK set. Without this, failover is impossible even if the backend data is perfectly replicated.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- Your Gateway communicates with backends via HTTP/1.1 connections. A slow backend service causes 'Head-of-Line Blocking'. How does switching to HTTP/2 as the Gateway-to-Backend transport mitigate this?
- What is the primary architectural role of an API Gateway in a microservices environment?
- Why is 'Stateless Token Validation' (e.g., using JWTs) significantly more scalable at the Gateway level than 'Stateful Validation' (e.g., using Opaque/Reference Tokens)?
- Your Gateway is configured to cache any URL ending in `.css` or `.jpg`. An attacker tricks a victim into visiting `https://api.com/v1/profile/info/style.css`. How can this lead to an 'Account Takeover'?
- An API is receiving a sudden surge of 10,000 requests per second from a single IP address. How does an API Gateway preserve the stability of the backend services?
- How can an API Gateway help prevent 'Double Charging' in a payment system when a mobile client retries a failed request due to a poor connection?