Api Gateway hard
You implement 'Traffic Mirroring' at the Gateway to test a new Payments Service (v2) with live traffic. Why must you ensure the v2 service is 'Sandboxed' or 'Mocked' for downstream side effects?
- A Because mirroring traffic doubles the bandwidth cost of the Gateway, which could lead to billing overages.
- B To prevent 'Side Effect Leakage': If the shadow service is live, it might unintentionally send real duplicate emails, process real credit card charges, or corrupt production data while it 'tests' the request.
- C Because mirroring only works if the v2 service uses the exact same IP address as the v1 service.
- D Mirroring traffic is illegal under GDPR unless the user explicitly opts into the shadow test.
Answer: B. To prevent 'Side Effect Leakage': If the shadow service is live, it might unintentionally send real duplicate emails, process real credit card charges, or corrupt production data while it 'tests' the request.
Shadowing is designed to find 'logic' bugs or 'performance' bottlenecks. However, an idempotent GET request is safe to mirror, but a POST request that triggers a chain of events (e.g., 'Order Created') must be isolated so the shadow version doesn't impact the real world.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- Your Gateway communicates with backends via HTTP/1.1 connections. A slow backend service causes 'Head-of-Line Blocking'. How does switching to HTTP/2 as the Gateway-to-Backend transport mitigate this?
- What is the primary architectural role of an API Gateway in a microservices environment?
- Why is 'Stateless Token Validation' (e.g., using JWTs) significantly more scalable at the Gateway level than 'Stateful Validation' (e.g., using Opaque/Reference Tokens)?
- Your Gateway is configured to cache any URL ending in `.css` or `.jpg`. An attacker tricks a victim into visiting `https://api.com/v1/profile/info/style.css`. How can this lead to an 'Account Takeover'?
- An API is receiving a sudden surge of 10,000 requests per second from a single IP address. How does an API Gateway preserve the stability of the backend services?
- How can an API Gateway help prevent 'Double Charging' in a payment system when a mobile client retries a failed request due to a poor connection?