Designing API Gateway and BFF Patterns
1. Designing Centralized API Gateway
| Concern | Handled At Gateway |
|---|---|
| Routing | Path/host → service |
| Auth | JWT/OIDC validation |
| Rate limit | Per consumer |
| Observability | Trace ID injection, access logs |
| Risk | Becomes monolith / SPOF if not HA |
2. Designing Backend for Frontend Pattern
| BFF Per | Reason |
|---|---|
| Web | Larger payloads, server-side render |
| Mobile | Compact payloads, battery-aware |
| Partner / 3rd-party | Stable contract, scoped data |
| Owned by | Frontend team for that channel |
3. Designing Request Routing and Load Balancing
| Strategy | Detail |
|---|---|
| Path-based | /api/orders → orders-svc |
| Host-based | api.example.com vs admin.example.com |
| Header-based | X-Tenant → tenant-specific cluster |
| Weighted | Canary / A-B |
| Geo-based | Route to nearest region |
4. Designing API Composition and Aggregation
Example: Aggregator BFF endpoint
// /bff/order-page/{id}
public OrderPage get(String id) {
var futures = List.of(
async(() -> orderSvc.get(id)),
async(() -> userSvc.get(orderUserId)),
async(() -> shippingSvc.track(id))
);
return OrderPage.from(awaitAll(futures, Duration.ofMillis(800)));
}| Pattern | Trade-off |
|---|---|
| Parallel fan-out | Faster; more load on backends |
| Sequential | Needed when one depends on another |
| Hedged requests | Lower tail latency |
5. Designing Protocol Translation
| Translation | Use |
|---|---|
| REST ↔ gRPC | Public REST, internal gRPC |
| REST ↔ GraphQL | Aggregated mobile API |
| SOAP ↔ REST | Legacy modernization |
| WebSocket ↔ MQ | Real-time over async backend |
6. Designing Request Transformation
| Transform | Use |
|---|---|
| Header rewrite | Add x-tenant-id, drop sensitive headers |
| Path rewrite | /v1/old → /v2/new |
| Body shaping | Strip fields, rename |
| Auth enrichment | Convert JWT → user context headers |
7. Designing Response Aggregation
| Pattern | Detail |
|---|---|
| Merge | Combine multiple responses into one JSON |
| Filter | Project only required fields per channel |
| Enrich | Add user context, locale |
| Cache aggregate | Short TTL; reduces backend fan-out |
8. Designing Gateway Security Policies
| Policy | Detail |
|---|---|
| TLS termination | TLS 1.3, HSTS |
| WAF rules | OWASP Core Rule Set |
| JWT verify | JWKS rotation; aud + iss check |
| IP allow/deny | For admin endpoints |
| Bot mgmt | Cloudflare, reCAPTCHA |
9. Designing Edge Computing Patterns
| Capability | Tech |
|---|---|
| Edge functions | Cloudflare Workers, Lambda@Edge, Vercel Edge |
| A/B routing | At edge for low-latency variant select |
| Auth at edge | JWT verify, OIDC redirect |
| KV at edge | Workers KV, Durable Objects |
10. Designing Gateway Caching Strategy
| Layer | Detail |
|---|---|
| Response cache | By URL + auth/tenant scope |
| Negative cache | Cache 404s briefly |
| Cache key vary | Vary: Accept-Language, Authorization |
| Invalidation | Surrogate-Key or tag-based purge |
11. Designing Gateway Rate Limiting
| Scope | Example |
|---|---|
| Per IP | 100 rps; DDoS edge |
| Per API key | Tier quotas (free/pro) |
| Per route | Heavier limits on /search |
| Burst | Token bucket: 200 burst, 50 sustained |
12. Designing Gateway Observability
| Signal | Detail |
|---|---|
| Access log | Method, path, status, latency, ua |
| Trace ID | Inject W3C traceparent |
| Metrics | Per-route p50/p95/p99, error rate |
| Audit | Auth events, policy denials |