Stop by Stop

Backend line

HTTP journey

Opening a web page sends a letter on a long trip through a company, and knowing each stop helps you find where a problem hides.

Words to know

Stops explain each step. The film plays the whole ride.

Explain it
Route
Inside the companyYouSending a letterPhone bookLooks up addressesFront deskDirects visitorsMailroomSorts the postDepartmentReads each letterFiling cabinetKeeps the records
  • Your letter going in
  • Waiting in line
  • A reply coming back
  • Something went wrong
Stop 1 of 11

You look up the address

You want to send a letter to a company, but you only know its name. So you ask the phone book for its street address.

Next stop: The phone book answers

All stops

The everyday version

Sending a letter to a company works the same way. Every stop has a twin in the building.

  • Youis the Browser

    Write the letter, post it, and wait for the reply.

  • The phone bookis the DNS resolver

    Turns the company’s name into its street address.

  • The front deskis the Load balancer

    Greets every visitor and sends each one to a free mailroom.

  • The mailroomis the Nginx

    Hands out simple things itself and passes real questions to the department.

  • The departmentis the App server

    Reads the letter and works out the answer.

  • The filing cabinetis the Database

    Keeps every record and finds the one you need.

  • No answeris a 502 or 504 error

    The mailroom finds the department closed, or gets tired of waiting. Either way, you get a note instead of a reply.

Interview questions

Say the short answer first. Go deeper only if they ask.

What happens when you type a URL and press Enter?
Short answer

DNS finds the address, TCP and TLS open a secure connection, then HTTP sends the request and the server answers.

If they dig deeper

Caches help at each layer, and a redirect can restart the trip. The browser then parses the HTML and requests more files. HTTP/2 multiplexes requests on one connection, and HTTP/3 uses QUIC instead of TCP.

Answer that loses points

“The browser connects straight to the database”, or skipping DNS and TLS.

What is the difference between an L4 and an L7 load balancer?
Short answer

L4 balances connections (TCP, UDP). L7 understands HTTP.

If they dig deeper

An L7 balancer can route by path, host or header, and can end TLS. An L4 one works at the connection level. Both run health checks, so requests go only to healthy targets, and round-robin is a common default.

Answer that loses points

“A load balancer stores user sessions.”

What does TLS give you?
Short answer

Encryption, integrity and server authentication.

If they dig deeper

A certificate signed by a trusted authority proves who the server is. In TLS 1.3 a Diffie-Hellman exchange then gives both sides a shared key in one round trip, and the data is encrypted with that fast symmetric key.

Answer that loses points

“HTTPS encrypts everything with the server’s public key for the whole session.”

What is the difference between 502 and 504?
Short answer

502: the proxy got an invalid response or none it could use. 504: the upstream did not answer in time.

If they dig deeper

RFC 9110 calls both gateway errors. In nginx, a refused or failed upstream connection gives 502, and a timeout gives 504 (proxy_read_timeout defaults to 60 seconds). Check whether the app is up for 502, and whether it is slow for 504.

Answer that loses points

“502 means the client did something wrong.”

Why is the client IP wrong behind a proxy, and how do you fix it?
Short answer

The app sees the proxy’s address. Read X-Forwarded-For, but only from a proxy you trust.

If they dig deeper

Have nginx send proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;. Uvicorn’s --proxy-headers is on by default but trusts only 127.0.0.1 unless you set --forwarded-allow-ips. Anyone who can reach the app directly can spoof the header.

Answer that loses points

“Just read X-Forwarded-For directly.”

What is a DNS TTL, and what happens when you change a record?
Short answer

The TTL says how long caches may keep an answer.

If they dig deeper

A cache may reuse an answer until its TTL runs out, so a changed record spreads gradually. Zero means do not cache. Lower the TTL ahead of a planned move.

Answer that loses points

“DNS changes take effect instantly everywhere.”

Why put Nginx in front of the app?
Short answer

It serves static files itself and forwards the rest to the app.

If they dig deeper

Uvicorn’s docs say a proxy in front “may not be necessary, but is recommended for additional resilience”. Nginx can also spread requests over several app copies with an upstream group, round-robin by default.

Answer that loses points

“Nginx runs my Python code.”

Cheat-sheet

Commands you will actually type.

dig +trace example.com

Follow DNS from the root name servers down to the answer.

curl -v https://example.com

Verbose output: connection details plus request and response headers.

curl -I https://example.com

Fetch the headers only.

curl --resolve example.com:443:203.0.113.10 https://example.com

Skip DNS and connect to this address. TLS still checks the name example.com.

openssl s_client -connect example.com:443 -servername example.com

Open a raw TLS connection and inspect the certificate.

nslookup example.com

A quick DNS lookup.

traceroute example.com

Show each router on the path, using probes with a rising TTL.

DevTools > Network > Timing

Splits a request into DNS lookup, initial connection, waiting (TTFB) and download.

Sources