← Back
Home › Systems › Networking and edge

api-gateway

API gateway with auth and quotas

Kong

SystemTechniques · 15Primitives · 59 api-gateway Deterministic simulation testingdistributed · medium: Run the whole system in one thread under a seeded scheduler with simulated network, disk and clock, so every failure replays from its seed.›Primary-backup replicationdistributed · medium: One node orders all writes and ships them to standbys; the acknowledgement rule (none, one, all) sets what a crash loses, and an external arbiter decides who takes over.›Coverage-guided fuzzingsecurity · medium: Mutate inputs, run an instrumented target, and keep any input that reaches a new code edge; feedback turns blind guessing into incremental search.›Tls terminationsecurity · medium: Terminate TLS at a proxy: SNI cert selection, session resumption, OCSP, kTLS offload (listed in Moved to the wiki)Point-in-time recoverystorage · medium: Periodic base backups plus a continuously archived change log let you rebuild the state as of any instant, then branch from there.›Distributed rate limitingsystems · medium: Enforce one rate limit across N servers: a central atomic counter, a limit split per node, or batched token leases, trading exactness against coordination cost.›Delta debuggingcompilers · medium: Ddmin minimization of failing inputs or change setsGCRAsystems · low: Generic Cell Rate Algorithm: a token bucket stored as one theoretical arrival time per key, updated with one compare-and-swap; exact limits in 8 bytes.›Sliding-window counterssystems · low: Count events in the last W seconds with a ring of sub-bucket counters; the two-bucket weighted estimate gives rate limits in 16 bytes per key.›Token bucketsystems · low: A bucket of up to b tokens refilled at rate r; requests spend tokens, enforcing an average rate while allowing bursts of b.›HTTP/1.1 message parsingnetworking · low: Parse HTTP/1.1 requests and responses incrementally from a byte stream: RFC 9112 body-length rules, chunked decoding and the strictness that stops request smuggling.›JSON Web Token (JWT)security · low: A signed, URL-safe token carrying claims; the verifier's job is the checklist (pinned algorithm, key by kid, exp, aud, iss), not the format.›Hdr histogramdata-structures · low: Log-linear bucketed histograms with bounded relative error for latency percentilesRadix triedata-structures · low: Compressed prefix tree for path routing, domain matching and prefix lookupsIdempotency keysfinance · low: Client-chosen unique key per logical operation, stored with a request fingerprint and the final response, so retries replay the first result instead of acting twice.›Process supervisionhardware-os · low: A parent process starts services, reaps their exits and restarts them under a delay and burst-limit policy, then stops them with SIGTERM before SIGKILL.›HTTP caching semanticsnetworking · low: The rules (RFC 9111) that decide whether a stored response is still fresh, and how a cheap conditional request revalidates it when it is not.›Authorization models (RBAC, ABAC, R…security · low: How to decide who may do what to which object; roles for coarse rules, relationships for sharing, and checks on every object.›Hmac request signingsecurity · low: HMAC canonical-request signatures and presigned URLs (SigV4 style) with expiryJSON Schema validationsecurity · low: Compile a JSON Schema once, then check every untrusted document against it, within hard size and depth limits, and report failures as JSON Pointers.›Mutual TLSsecurity · low: TLS where the client also proves a certificate key, so every connection carries a verified, rotatable machine identity.›OAuth 2 and OpenID Connectsecurity · low: Delegated authorization (OAuth 2) and login on top of it (OIDC); use authorization code + PKCE for every user-facing client.›Circuit breakersystems · low: Stop calling a failing dependency for a while, probe it with trial calls, and resume on recovery: fail fast instead of piling up timeouts.›+ 8 more techniques+ 43 more primitives

Similar systems

Share the most building blocks with this one.

global-rate-limiter 48 %open-banking 44 %multi-tenant-saas 41 %zero-trust 41 %forward-proxy 40 %

In-house systems

Named systems of this kind at large companies, with their paper or write-up.

ZuulNetflix