Api Gateway hard
Your API is receiving a large stream of data from a fast client, but the backend worker is processing it very slowly. How can the API Gateway use 'TCP Backpressure' to prevent its own memory from being exhausted by the buffering?
- A By automatically dumping the excess data to a local `/tmp` file on the Gateway's disk.
- B By stopping the internal 'read' calls on the client's socket. This causes the Gateway's OS-level receive buffer to fill up, which eventually signals a 'Zero Window' to the client's TCP stack, forcing the client to slow down.
- C By sending an 'ICMP Redirect' packet to the client to tell them to find a different Gateway.
- D TCP Backpressure is a myth; you must implement an SQS queue at the Gateway level to handle flow control.
Answer: B. By stopping the internal 'read' calls on the client's socket. This causes the Gateway's OS-level receive buffer to fill up, which eventually signals a 'Zero Window' to the client's TCP stack, forcing the client to slow down.
Backpressure is the 'Propagating Signal' to slow down. If the Gateway blindly accepting data at 1GB/s but can only flush it to a backend at 10MB/s, it will eventually run out of RAM. The most efficient way to handle this is at the TCP layer, using the built-in flow control window to force the sender to adapt to the receiver's real-time capacity.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- Your Gateway communicates with backends via HTTP/1.1 connections. A slow backend service causes 'Head-of-Line Blocking'. How does switching to HTTP/2 as the Gateway-to-Backend transport mitigate this?
- What is the primary architectural role of an API Gateway in a microservices environment?
- Why is 'Stateless Token Validation' (e.g., using JWTs) significantly more scalable at the Gateway level than 'Stateful Validation' (e.g., using Opaque/Reference Tokens)?
- Your Gateway is configured to cache any URL ending in `.css` or `.jpg`. An attacker tricks a victim into visiting `https://api.com/v1/profile/info/style.css`. How can this lead to an 'Account Takeover'?
- An API is receiving a sudden surge of 10,000 requests per second from a single IP address. How does an API Gateway preserve the stability of the backend services?
- How can an API Gateway help prevent 'Double Charging' in a payment system when a mobile client retries a failed request due to a poor connection?