Api Gateway hard
Your API uses JWTs for stateless authentication. However, large tokens (containing many claims) are causing 'Header Too Large' errors. How does the 'Phantom Token Pattern' resolve this without losing statelessness in the backend?
- A By compressing the JWT using GZIP before sending it to the client, which is then unzipped by the Gateway.
- B The client receives an Opaque/Reference token. The Gateway intercepts it, retrieves the full JWT from a high-speed cache (like Redis), and replaces the Opaque token with the JWT before forwarding it to the backend services.
- C By splitting the JWT into multiple smaller headers (e.g., X-JWT-1, X-JWT-2) that are merged by the microservices.
- D By moving the authentication data from the Header to the HTTP Body for all GET requests.
Answer: B. The client receives an Opaque/Reference token. The Gateway intercepts it, retrieves the full JWT from a high-speed cache (like Redis), and replaces the Opaque token with the JWT before forwarding it to the backend services.
This pattern provides the best of both worlds: The client stays 'light' with a small opaque token (no sensitive data leaks), but internal microservices remain 'stateless' because the Gateway has already performed the lookup and provided them with the full, rich identity context (the JWT).
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- Your Gateway communicates with backends via HTTP/1.1 connections. A slow backend service causes 'Head-of-Line Blocking'. How does switching to HTTP/2 as the Gateway-to-Backend transport mitigate this?
- What is the primary architectural role of an API Gateway in a microservices environment?
- Why is 'Stateless Token Validation' (e.g., using JWTs) significantly more scalable at the Gateway level than 'Stateful Validation' (e.g., using Opaque/Reference Tokens)?
- Your Gateway is configured to cache any URL ending in `.css` or `.jpg`. An attacker tricks a victim into visiting `https://api.com/v1/profile/info/style.css`. How can this lead to an 'Account Takeover'?
- An API is receiving a sudden surge of 10,000 requests per second from a single IP address. How does an API Gateway preserve the stability of the backend services?
- How can an API Gateway help prevent 'Double Charging' in a payment system when a mobile client retries a failed request due to a poor connection?