Art of Codeartofcode
Lesson 10 of 17

7. Load Balancers, Reverse Proxies and API Gateways

1
The picture to keep in your head
2
7.1 Why do we need a load balancer?
3
7.2 What's the difference between a layer 4 and a layer 7 load balancer?
4
7.3 How does the load balancer choose a server?
5
7.4 How does the load balancer know a server is dead?
6
7.5 What are sticky sessions, and should you use them?
7
7.6 What is SSL termination?
8
7.7 If everything goes through the load balancer, what if it fails?
9
7.8 What's the difference between a forward proxy and a reverse proxy?
10
7.9 What is an API gateway?
11
7.10 How do you balance traffic across regions?
12
Memory card and where the analogy breaks
13
Practice: five levels
14
Interview questions
15
Solutions
16
Sources
17
Code lab
7. Load Balancers, Reverse Proxies and API Gateways

7.9 What is an API gateway?

3 min read+10 XP

At the airport: Before anyone reaches the gates, the security checkpoint checks every passenger's ID and boarding pass, limits what they carry, and points them to the right terminal. Each airline doesn't run its own security.

In the system: An API gateway is a reverse proxy at the front of your APIs that handles the jobs every request needs, so each service doesn't repeat them:

forward proxy vs reverse proxy, and an API gateway routing to catalogue, cart and payments services.

Figure: a forward proxy hides the clients; a reverse proxy or API gateway hides the servers and does the shared work at the front door.

  • Authentication: check the token or API key once (Chapter 3, section 3.11).
  • Rate limiting: stop one client from flooding the system (Chapter 25).
  • Routing: /books/* to the catalogue service, /cart/* to the cart service (useful with microservices, Chapter 27).
  • Cross-cutting chores: TLS, request logging, metrics, request IDs for tracing (Chapter 30), sometimes response caching or changing request formats.

The risks: it's one more hop (a little latency) and a critical shared component, so it needs the same redundancy as a load balancer. And keep business logic out of it: a gateway stuffed with special cases becomes a bottleneck every team must queue to change.

For the bookstore: the mobile app and website both hit the gateway, which checks the user's token and rate-limits checkout before anything reaches the services.

Memory code: "Check ID once at the gate, not at every counter."