Fix: The Wide-Open API

Your mobile app talks directly to three microservices. There is no authentication layer — each service "trusts" the app. The uploads bucket is public (someone already found customer files via URL guessing), and a scraper is hammering the catalog at 50 req/s. The canvas shows the current exposure. Lock the system down without breaking legitimate clients.

Requirements

•All client traffic converges on a single guarded entry point (API gateway)
•Requests carry verifiable identity (token-based auth validated at the entry point)
•Edge protection filters malicious traffic (WAF) and rate limits curb the scraper
•The file bucket becomes private, accessed via controlled, expiring references (signed URLs)

Non-Functional Requirements

•Legitimate client latency overhead from the new layers must stay under 50ms

Constraints

•Do not redesign the services' business logic — the problem is the exposure surface

Evaluation Criteria

Evaluation criteria and weights will be revealed after you submit your solution. This ensures a fair assessment of your design skills.

Ready to solve this challenge?

Draw your architecture diagram, explain your design decisions, and get AI-powered feedback.

For the best experience, design challenges on a desktop or tablet — drawing the architecture on a phone is hard.

Start drawing nowNo account needed to draw. Sign up only to see your score (2 free evaluations).Already have an account? Sign in