wtf( )unctionsystem design, drawn
← all problemsOSI ModelMedium

The rule that could not see the path

The requirement is to send /api/* to one backend and everything else to another, and to block any request whose body contains a particular pattern.

The balancer in front is a layer-4 device. It forwards the TCP stream and terminates nothing, so it can see addresses and ports. The path is inside the encrypted payload, and so is the body. Neither rule can be expressed by a device that never sees the plaintext.

Put the decision points where the information they need actually exists.
Components — tap one, then tap a slot on the diagram
?A device can only act on what it can read, and what it can read is decided by where the encryption ends.

Boundaries, outermost first: Encrypted to here: Layer-4 balancer (addresses, ports), The two rules (by path, by body; FAILED: not expressible here), Client (sends HTTPS) Outside every boundary: Web backend (everything else), API backend (wants /api/*), an empty slot for the where the session ends, an empty slot for the where a body can be read Connections: Client calls Layer-4 balancer (step 1) Layer-4 balancer calls where the session ends — still opaque (step 2) where the session ends calls API backend (step 3) where the session ends calls Web backend (step 4) where a body can be read controls where the session ends — sees plaintext (step 5) The two rules must NOT reach Layer-4 balancer — no visibility here

Layer-4 balanceraddresses, ports
The two rulesby path, by bodynot expressible here
Clientsends HTTPS
Web backendeverything else
API backendwants /api/*