| What is the API Gateway Pattern, and why is it used in microservices architecture? |
| What are the primary responsibilities of an API Gateway? |
| What is the difference between an API Gateway and a reverse proxy? |
| What is the difference between an API Gateway and a load balancer? |
| What is the difference between an API Gateway and a service mesh? |
| How does a request flow through Spring Cloud Gateway? |
| What are routes, predicates, and filters in Spring Cloud Gateway? |
| What is the difference between GatewayFilter and GlobalFilter? |
| How do you configure routes in Spring Cloud Gateway? |
| How do you implement a custom GlobalFilter? |
| How does filter ordering work in Spring Cloud Gateway? |
| How do you route requests based on paths, headers, hosts, and HTTP methods? |
| How do you rewrite request paths before forwarding them to a microservice? |
| What is the difference between StripPrefix and RewritePath? |
| How do you route requests dynamically using service discovery? |
| How do you integrate Spring Cloud Gateway with Eureka? |
| How does load balancing work with Spring Cloud Gateway? |
| What is the difference between static routing and service-discovery-based routing? |
| How do you implement API versioning through an API Gateway? |
| How do you implement canary routing using Spring Cloud Gateway? |
| How do you secure an API Gateway using Spring Security? |
| How do you configure JWT authentication in Spring Cloud Gateway? |
| Which JWT claims should be validated by an API Gateway? |
| What is the difference between OAuth 2.0 and OpenID Connect? |
| How do you implement role-based authorization at the gateway? |
| What is token relay, and how is it implemented in Spring Cloud Gateway? |
| How do you propagate authentication information to downstream microservices? |
| Why should microservices enforce authorization even when the gateway authenticates requests? |
| How do you implement API key authentication, and what are its limitations? |
| How do you configure CORS in Spring Cloud Gateway? |
| What is rate limiting, and why is it important for an API Gateway? |
| How do you implement Redis-based rate limiting in Spring Cloud Gateway? |
| How does the token-bucket algorithm work? |
| How do you implement different rate limits for different users and clients? |
| How do you enforce rate limits across multiple gateway instances? |
| What is the difference between rate limiting and throttling? |
| How should an API Gateway handle requests that exceed rate limits? |
| How do you configure connection and response timeouts for downstream services? |
| What is a circuit breaker, and how do you configure it for gateway routes? |
| How do you integrate Resilience4j with Spring Cloud Gateway? |
| What is the difference between a timeout, retry, circuit breaker, and fallback? |
| How do you configure retries without creating duplicate transactions? |
| Why should retries use exponential backoff and jitter? |
| How do you prevent cascading failures across microservices? |
| How do you implement fallback responses when a downstream service is unavailable? |
| How do you handle HTTP 401, 403, 404, 429, 502, 503, and 504 responses? |
| How do you standardize error responses returned by the gateway? |
| How do you implement request and response header transformation? |
| How do you validate incoming requests and restrict payload sizes? |
| How do you prevent clients from spoofing identity and forwarded headers? |
| How do you configure TLS termination at an API Gateway? |
| What is mutual TLS, and when should it be used? |
| How do you manage certificates and secrets securely for gateway deployments? |
| How do you implement correlation IDs across gateway and microservice requests? |
| How do you integrate OpenTelemetry and Micrometer Tracing with Spring Cloud Gateway? |
| How do you monitor gateway latency, throughput, error rates, and saturation? |
| Why are p95 and p99 latency metrics important for gateway monitoring? |
| How do you troubleshoot a 502 Bad Gateway error in production? |
| How do you troubleshoot a 504 Gateway Timeout error? |
| How do you investigate high latency when downstream services appear healthy? |
| How do you configure structured logging without exposing tokens or sensitive data? |
| How does reactive programming improve API Gateway scalability? |
| Why should blocking operations be avoided in Spring Cloud Gateway's reactive event loop? |
| How do you identify and resolve memory pressure and connection-pool exhaustion? |
| How do you configure connection pooling and keep-alive for gateway traffic? |
| What is backpressure, and why is it important in reactive gateway applications? |
| How do you implement response caching at an API Gateway? |
| How do you handle cache invalidation and prevent stale responses? |
| When should gateway caching be avoided for sensitive or user-specific data? |
| What is the Backend for Frontend pattern, and when should it be used? |
| What is gateway aggregation, and how do you handle parallel downstream calls? |
| When should aggregation logic be moved from the gateway into a dedicated service? |
| How do you prevent one slow downstream call from delaying an aggregated response? |
| What is the Strangler Pattern, and how can a gateway support legacy modernization? |
| How do you integrate API Gateway with Kafka-based asynchronous microservices? |
| How do you route WebSocket connections through an API Gateway? |
| How do you document gateway routes using OpenAPI and Swagger? |
| How do you test route predicates and custom filters using Spring Boot tests? |
| How do you use WireMock to test gateway behavior when downstream services fail? |
| How do you perform load testing and stress testing for an API Gateway? |
| How do you deploy Spring Cloud Gateway to Kubernetes? |
| What is the difference between Kubernetes Ingress and Gateway API? |
| How do you configure readiness and liveness probes for gateway instances? |
| How do you achieve high availability using multiple gateway replicas? |
| How do you deploy gateway configuration changes without downtime? |
| How do you implement blue-green and canary deployments for gateway services? |
| How do you manage gateway routes and environment-specific configuration? |
| How do you prevent invalid route configuration from breaking production traffic? |
| How do you implement graceful shutdown while preserving in-flight requests? |
| How do you implement tenant-aware routing and per-tenant authorization? |
| How do you isolate one tenant's traffic from other tenants? |
| How do you design an API Gateway for banking or payment microservices? |
| How do you prevent duplicate payment requests when the gateway experiences timeouts? |
| How do you secure public APIs against abuse, oversized payloads, and malicious requests? |
| How do you design regional routing and failover for a multi-region gateway? |
| How do you estimate API Gateway capacity based on requests per second and latency? |
| How do you determine whether the API Gateway itself has become a performance bottleneck? |
| What are the most common API Gateway anti-patterns in microservices architecture? |
| How do you decide which responsibilities belong in the gateway versus individual microservices? |
| How would you design a production-ready Spring Cloud Gateway architecture with security, resilience, observability, and high availability? |
