APPLICATION DELIVERY · TRAFFIC CONTROL

Route one request through a system that can partly fail.

A reverse proxy, load balancer and API gateway may occupy one product or several layers, but their responsibilities differ. Toggle health, latency and routing policy to derive 200, 502, 503 and 504 from evidence.

REQUEST ROUTING SIMULATOR

The status code should identify where the promise broke

This simulation distinguishes connection failure, no healthy capacity and an upstream that exceeded the gateway deadline.

PathLoad balancingGateway timeout (ms)Requests to send

backend-1 healthy backend-2 healthy backend-3 healthy Selected upstream refuses connection

backend-1 latencybackend-2 latencybackend-3 latency

ClientHTTPS requestrequest-id

Reverse proxyTLS · host · staticX-Forwarded-*

API gatewayauth · rate · routedeadline

Backend poolbalance · health1 · 2 · 3

READY · Send a request to observe its route.

IDLENo request in flight.

2xx0

502 / 503 / 5040 / 0 / 0

Mean successful latency—

SEPARATE THE ROLES

Similar boxes, different decisions

Reverse proxy

Represents origin services to clients: terminate TLS, select virtual host, serve/cache content and forward trusted metadata.

Load balancer

Distributes work across eligible instances using health and a balancing policy.

API gateway

Applies API policy: authentication, authorization, quota, transformation, routing, observability and deadlines.

FAILURE SEMANTICS

502, 503 and 504 are not interchangeable

Status	Evidence	Meaning	Retry question
502 Bad Gateway	Connection refused, malformed upstream response	Gateway could not obtain a valid upstream response.	Is the operation idempotent?
503 Service Unavailable	No healthy instances or capacity intentionally unavailable	Service cannot accept work now.	Honor Retry-After and use backoff.
504 Gateway Timeout	Upstream exceeded gateway deadline	Outcome may be unknown; the upstream might still complete.	Could retry duplicate a side effect?

HEADERS AND TRUST BOUNDARIES

Forward context without accepting a forged story

X-Request-ID

Correlates logs across hops. Generate or validate it at a trusted boundary.

X-Forwarded-For

A chain of addresses; do not trust arbitrary client-supplied values.

X-Forwarded-Proto

Tells the origin whether the external request used HTTPS after TLS termination.

Host / Forwarded

Preserves routing context but must be validated against allowed hosts.

CLASSROOM TASKS

Make the failure explain itself

Disable every backend and explain why the result is 503, not 502.
Set one healthy backend beyond the deadline and derive 504.
Compare round robin with least connections under unequal latency.
Design an idempotency key for a payment-like POST before retrying.
Decide where TLS should terminate and whether the internal hop also needs TLS.
Build a latency budget across edge, gateway, service and database.