CS fundamentals

API and Web Architecture

HTTP, REST, auth, caching, gateways and microservices from first principles.

  • Handwritten-style
  • Diagrams and tables
  • Worked examples
Start reading

Who this notebook is for

Developers and freshers who build or call web services and want to understand them end to end, from the HTTP request to the way large systems stay reliable.

What you will be able to do

  • Explain how an HTTP request and response work and what each status code means
  • Design a REST API with sensible resources, pagination and versioning
  • Compare sessions, JWT and OAuth and know where each fits
  • Describe how caches, gateways and reverse proxies sit in front of a service

What's inside

Pick a chapter and the notebook opens right there.

  1. Client-Server & StandardsSeparation of Concerns, Statelessness, DNS & Sockets, URIs/URLs, MIME Types, RFC StandardsStart here
  2. HTTP/1.1 ProtocolWire Framing, Start Line, CRLF, HTTP Verbs, Idempotency, Status Code Taxonomy, Range HeadersStart here
  3. HTTP/2 & HTTP/3HoL Blocking, Binary Framing, Streams, Multiplexing, HPACK, QUIC UDP, 0-RTT, Connection MigrationStart here
  4. RESTful API DesignFielding 6 Constraints, Resource Modeling, CRUD Standards, Keyset vs Offset Pagination, HATEOASStart here
  5. Request & Response PayloadsJSON Serialization, Protobuf Binary Varints, MessagePack, OpenAPI 3.0, Versioning StrategiesStart here
  6. Auth & AuthorizationStateful Sessions vs Stateless JWT, Claims, Security Traps ('none' alg), OAuth 2.0 PKCE, OIDCStart here
  7. API Security Best PracticesSOP & CORS Preflight, CSRF Double-Submit, Rate Limiting (Token Bucket), OWASP API Top 10 (BOLA/SSRF)Start here
  8. Web Caching ArchitectureCache Hierarchy, Cache-Control Directives, ETags, Stale-While-Revalidate, CDNs, Surrogate KeysStart here
  9. Asynchronous ArchitectureShort vs Long Polling, Server-Sent Events (SSE), WebSockets RFC 6455, Webhooks, Protocol MatrixStart here
  10. GraphQL vs REST vs gRPCOver/Under-Fetching, GraphQL SDL & Resolvers, DataLoader N+1, gRPC HTTP/2, Decision MatrixStart here
  11. Web Servers & ProxiesWeb vs App Server vs Reverse Proxy, Nginx epoll Master-Worker, proxy_pass, Load Balancing, CaddyStart here
  12. API Gateways & TrafficCentralized Ingress, Routing & SSL Offload, Kong/Envoy, Canary Releases, JSON- gRPC Transcoding, BFFStart here
  13. Microservices & MeshMonolith vs Microservices, Dynamic Service Discovery, Sidecar Proxy, Istio/Envoy, mTLS SPIFFEStart here
  14. Reliability & ResiliencyDistributed Fallacies, Idempotency Keys, Full Jitter Backoff, Circuit Breakers, Timeouts, BulkheadsStart here
  15. Observability & TracingThree Pillars, Structured JSON Logs, W3C Trace Context, OpenTelemetry, RED Method & Golden SignalsStart here
  16. SSL/TLS & PKIHybrid Cryptography, TLS 1.2 vs 1.3 1-RTT, Certificate Chain of Trust, X.509 SANs, OCSP Stapling, PFSStart here
  17. High-Throughput TuningHTTP Keep-Alive, Connection Pooling, Linux SO_REUSEPORT, Brotli vs Zstd, Java 21 Virtual ThreadsStart here
  18. Top 30 FAANG DrillsProtocols, REST Design, OAuth PKCE, Caching, Microservice Resiliency, Staff Architect RubricStart here

Practice this

Put it to work on LakeBench.

Common questions

Is this about building APIs or using them?
Both. It explains the protocols and design rules first, then the production topics such as security, caching and tracing.
Do I need to know a backend framework?
No. The ideas apply to any framework, and the examples are shown as plain requests and responses.
Can I read a sample before I commit?
Yes. The contents pages and the first pages of every notebook can be read online, so you can judge the style before going further.

More in CS fundamentals

All notebooks