Ashok Sahoo

Full-Stack Engineer | Building real-world systems across the stack | Sharing real-world lessons on performance, failures, and trade-offs

[Ashok Sahoo @ashoKumar89]

An API Gateway is not just a reverse proxy. It’s the control plane in front of your services.

If you’re building microservices and don’t have one, your architecture will eventually get messy.

Here’s what it actually does 👇

What is an API Gateway?
It’s a single entry point that sits between clients and your backend services.

Instead of:
Client → Service A
Client → Service B
Client → Service C

You have:
Client → API Gateway → Internal Services

The gateway handles cross-cutting concerns so your services don’t have to.

What does it do?
An API Gateway typically handles authentication, authorization, rate limiting, request routing, response aggregation, logging, monitoring, and sometimes caching.

It can:
- Validate JWT tokens
- Enforce rate limits
- Route /users to User Service
- Route /payments to Payment Service
- Combine multiple service responses into one

Your microservices stay focused on business logic.

When do you need it?
You likely need an API Gateway when:
- You have multiple microservices
- You want centralized authentication
- You need rate limiting at the edge
- You want to hide internal service structure
- You are exposing public APIs

If you have a simple monolith, you probably don’t need one yet.

Common real-world examples:
Netflix, Amazon, and most SaaS platforms use API gateways to manage traffic at scale.

Popular solutions include:
- NGINX
- Kong
- AWS API Gateway
- Envoy

Without an API Gateway:
Every service reimplements auth, logging, and rate limiting.

With an API Gateway:
Infrastructure concerns are centralized and standardized.

It’s not just traffic routing. It’s architecture discipline.

Building microservices? Repost. Follow. Bookmark this.

[Ashok Sahoo @ashoKumar89]

@kumarakh Yes. Attackers often care more about discovering valid targets than breaking encryption.

[Ashok Sahoo @ashoKumar89]

What security issue do you see?

[Ashok Sahoo @ashoKumar89]

@krunalbuilds Good catch on the timing aspect. Many teams fix the error message but still leak account existence through response time.

[Ashok Sahoo @ashoKumar89]

@HaramzadaWala @SumitM_X You can authenticate over HTTP too.

The difference is that HTTPS authenticates the server itself via certificates, so the client knows it’s talking to the real site and not a man-in-the-middle.

[Ashok Sahoo @ashoKumar89]

The best architecture document is not the one with the most diagrams.

It is the one that prevents the most mistakes.

[Ashok Sahoo @ashoKumar89]

An API returns these responses.

What security issue does this create?

[Ashok Sahoo @ashoKumar89]

@shramanb113 That’s the trade-off. The more helpful the error message is for developers, the more useful it becomes for attackers.

[Ashok Sahoo @ashoKumar89]

An API returns these responses.

What security issue does this create?

[Ashok Sahoo @ashoKumar89]

@krunalbuilds True. Helpful error messages for developers can become reconnaissance tools for attackers.

[Ashok Sahoo @ashoKumar89]

@aminnnn_09 Graceful degradation is a great addition. A partial service is usually better than a complete outage.

Timeouts + retries with backoff. Individually they are useful. Together they save a lot of pain.

[Ashok Sahoo @ashoKumar89]

10 practices for building reliable backend systems:

1. Set timeouts on every external call
2. Implement retries with backoff
3. Use circuit breakers
4. Design idempotent APIs
5. Handle partial failures explicitly
6. Add health checks
7. Graceful shutdown handling
8. Queue critical workflows
9. Monitor error rates
10. Plan for failure, not success

[Ashok Sahoo @ashoKumar89]

@krunalbuilds Agreed. If you assume failure from day one, most of the other practices become obvious.

[Ashok Sahoo @ashoKumar89]

@MubarackTahir Depends on the implementation of saveFile(). A lot of upload handlers write to temp storage first, then expose file.size to application code. By then, the resources have already been consumed. That’s the point of the example.

[Ashok Sahoo @ashoKumar89]

This API rejects files larger than 10MB.

What could go wrong?

[Ashok Sahoo @ashoKumar89]

@mguimaraesfilho That is usually the application-level fix. I’d still keep limits at the proxy/load balancer too for defense in depth.

[Ashok Sahoo @ashoKumar89]

@patilvishi Yes. This turns a size validation issue into a potential DoS vector.

[Ashok Sahoo @ashoKumar89]

@krunalbuilds The difference between validating before and after storage is huge at scale.

[Ashok Sahoo @ashoKumar89]

Most engineers underestimate network failures and overestimate compute problems.

Servers are fast. Networks are where reality begins.

[Ashok Sahoo @ashoKumar89]

@proxy_vector Yes. The right composite index can help filtering and sorting at the same time.

[Ashok Sahoo @ashoKumar89]

There are separate indexes on both columns.

The query is still slow.

What index might still be missing?