System Design
Learn System Design
Introduction to System Design
How to Learn System Design?
Key Characteristics of Distributed Systems
Scalability
Availability
Latency and Performance
Concurrency and Coordination
Monitoring and Observability
Resilience and Error Handling
Fault Tolerance vs. High Availability
Flashcards Review
Chapter Assessment
Long-Polling vs. WebSockets vs. Server-Sent Events
Introduction to Real-Time Communication
What is Long-Polling?
What is WebSocket?
What are Server-Sent Events?
Difference Between Long-Polling, WebSockets, and Server-Sent Events
Flashcards Review
Chapter Assessment
Domain Name System (DNS)
Introduction to DNS
DNS Resolution Process
DNS Load Balancing and High Availability
Flashcards Review
Chapter Assessment
Proxies
What is a Proxy Server?
Uses of Proxies
VPN vs. Proxy Server
Flashcards Review
Chapter Assessment
Load Balancing
Introduction to Load Balancing
Load Balancing Algorithms
Uses of Load Balancing
Load Balancer Types
Stateless vs. Stateful Load Balancing
High Availability and Fault Tolerance
Scalability and Performance
Challenges of Load Balancers
Flashcards Review
Chapter Assessment
API Gateway
Introduction to API Gateway
Usage of API gateway
Advantages and disadvantages of using API gateway
Flashcards Review
Chapter Assessment
API Design
What Is an API?
What Are REST APIs?
Resources, Not Actions
HTTP Methods and Their Semantics
URL Design
Request and Response Shapes
Status Codes and Error Design
Pagination from the Consumer's View
Idempotency Keys
Versioning and Backward Compatibility
Concurrency and Conditional Requests
REST vs gRPC vs GraphQL
Flashcards Review
Chapter Assessment
Rate Limiting and Throttling
What Is Rate Limiting
Rate Limiting Algorithms
Distributed Rate Limiting
Rate Limiting in Practice
Flashcards Review
Chapter Assessment
Caching
Introduction to Caching
Why is Caching Important?
Types of Caching
Cache Replacement Policies
Cache Invalidation
Cache Read Strategies
Cache Coherence and Consistency Models
Caching Challenges
Cache Performance Metrics
Flashcards Review
Chapter Assessment
CDN
What is CDN?
Origin Server vs. Edge Server
CDN Architecture
Push CDN vs. Pull CDN
Flashcards Review
Chapter Assessment
Data Partitioning
Introduction to Data Partitioning
Partitioning Methods
Data Sharding Techniques
Benefits of Data Partitioning
Common Problems Associated with Data Partitioning
Flashcards Review
Chapter Assessment
Redundancy and Replication
What is Redundancy?
What is Replication?
Replication Methods
Data Backup vs. Disaster Recovery
Flashcards Review
Chapter Assessment
CAP & PACELC Theorems
Introduction to CAP Theorem
Components of CAP Theorem
Trade-offs in CAP Theorem
Examples of CAP Theorem in Practice
Beyond CAP Theorem
System Design Trade-offs in Interviews
Flashcards Review
Chapter Assessment
Databases (SQL vs. NoSQL)
Introduction to Databases
SQL Databases
NoSQL Databases
SQL vs. NoSQL
ACID vs BASE Properties
Real-World Examples and Case Studies
SQL Normalization and Denormalization
In-Memory Database vs. On-Disk Database
Data Replication vs. Data Mirroring
Database Federation
Flashcards Review
Chapter Assessment
Indexes
What are Indexes?
How a B-Tree Index Works
Types of Indexes
B-Tree vs. LSM Tree
Indexes in Distributed Systems
Flashcards Review
Chapter Assessment
Bloom Filters
Introduction to Bloom Filters
Benefits & Limitations of Bloom Filters
Variants and Extensions of Bloom Filters
Applications of Bloom Filters
Flashcards Review
Chapter Assessment
Quorum
Why Quorum?
What is Quorum?
Flashcards Review
Chapter Assessment
Leader and Follower
What is Leader and Follower Pattern?
Flashcards Review
Chapter Assessment
Heartbeat
What is Heartbeat?
Flashcards Review
Chapter Assessment
Checksum
What is Checksum?
Uses of Checksum
Flashcards Review
Chapter Assessment
Distributed Messaging System
Introduction to Messaging System
Introduction to Kafka
Messaging patterns
Popular Messaging Queue Systems
RabbitMQ vs. Kafka vs. ActiveMQ
Scalability and Performance
Flashcards Review
Chapter Assessment
Distributed File Systems
What is a Distributed File System?
Architecture of a Distributed File System
Key Components of a DFS
Flashcards Review
Chapter Assessment
Security
What is Security and Privacy?
What is Authentication?
What is Authorization?
Authentication vs. Authorization
OAuth vs. JWT for Authentication
What is Encryption?
What are DDoS Attacks?
Flashcards Review
Chapter Assessment
Misc Concepts
Batch Processing vs. Stream Processing
XML vs. JSON
Synchronous vs. Asynchronous Communication
Push vs. Pull Notification Systems
Microservices vs. Serverless Architecture
Message Queues vs. Service Bus
Stateful vs. Stateless Architecture
Event-Driven vs. Polling Architecture
Flashcards Review
Chapter Assessment
Quiz - System Design Fundamentals
Quiz
System Design Trade-offs
Importance of Discussing Trade-offs
Strong vs Eventual Consistency
Latency vs Throughput
ACID vs BASE Properties in Databases
Read-Through vs Write-Through Cache
Batch Processing vs Stream Processing
Load Balancer vs. API Gateway
API Gateway vs Direct Service Exposure
Proxy vs. Reverse Proxy
API Gateway vs. Reverse Proxy
SQL vs. NoSQL
Primary-Replica vs Peer-to-Peer Replication
Data Compression vs Data Deduplication
Server-Side Caching vs Client-Side Caching
REST vs RPC
Polling vs. Long-Polling vs. WebSockets vs. Webhooks
CDN Usage vs Direct Server Serving
Serverless Architecture vs Traditional Server-based
Stateful vs Stateless Architecture
Hybrid Cloud Storage vs All-Cloud Storage
Token Bucket vs Leaky Bucket
Read Heavy vs Write Heavy System
Quiz
How to Approach a System Design Interview
System Design Interviews - A step by step guide
Functional vs. Non-functional Requirements
What are Back-of-the-Envelope Estimations?
Things to Avoid During System Design Interview
System Design Master Template
System Design Master Template
Quiz
Designing a URL Shortening Service like TinyURL
Designing a URL Shortening Service like TinyURL
Quiz - Designing URL Shortner
Designing Pastebin
Designing Pastebin
Quiz - Designing Pastebin
Designing Instagram
Designing Instagram
Quiz - Designing Instagram
Designing Dropbox
Designing Dropbox
Quiz - Designing Dropbox
Designing Facebook Messenger
Designing Facebook Messenger
Quiz - Designing Facebook Messenger
Designing Twitter
Designing Twitter
Quiz - Designing Twitter
Designing Youtube or Netflix
Designing Youtube or Netflix
Quiz - Designing Youtube
Designing Typeahead Suggestion
Designing Typeahead Suggestion
Quiz - Designing Typeahead Suggestion
Designing an API Rate Limiter
Designing an API Rate Limiter
Quiz - Designing an API Rate Limiter
Designing Twitter Search
Designing Twitter Search
Quiz - Designing Twitter Search
Designing a Web Crawler
Designing a Web Crawler
Quiz - Designing a Web Crawler
Designing Facebook’s Newsfeed
Designing Facebook’s Newsfeed
Quiz - Designing Facebook’s Newsfeed
Designing Yelp or Nearby Friends
Designing Yelp or Nearby Friends
Quiz - Designing Yelp or Nearby Friends
Designing Uber backend
Designing Uber backend
Quiz - Designing Uber backend
Designing Ticketmaster
Designing Ticketmaster
Quiz - Designing Ticketmaster
Dynamo: How to design a key value store?
Dynamo: Introduction
High-Level Architecture
Data Partitioning
Replication
Vector Clocks and Conflicting Data
The Life of Dynamo’s put() & get() Operations
Anti-entropy Through Merkle Trees
Gossip Protocol
Dynamo Characteristics and Criticism
Summary: Dynamo
Quiz: Dynamo
Mock Interview: Dynamo
Designing YouTube Likes Counter (medium)
YouTube Likes Counter
Quiz
Cassandra: How to Design a Wide-column NoSQL Database?
Cassandra: Introduction
High-level Architecture
Replication
Cassandra Consistency Levels
Gossiper
Anatomy of Cassandra's Write Operation
Anatomy of Cassandra's Read Operation
Compaction
Tombstones
Summary: Cassandra
Quiz: Cassandra
Mock Interview: Cassandra
Kafka: How to Design a Distributed Messaging System?
Messaging Systems: Introduction
Kafka: Introduction
High-level Architecture
Kafka: Deep Dive
Consumer Groups
Kafka Workflow
Role of ZooKeeper
Controller Broker
Kafka Delivery Semantics
Kafka Characteristics
Summary: Kafka
Quiz: Kafka
Mock Interview: Kafka
Chubby: How to Design a Distributed Locking Service?
Chubby: Introduction
High-level Architecture
Design Rationale
How Chubby Works
File, Directories, and Handles
Locks, Sequencers, and Lock-delays
Sessions and Events
Master Election and Chubby Events
Caching
Database
Scaling Chubby
Summary: Chubby
Quiz: Chubby
Mock Interview: Chubby
HDFS: How to Design File Storage System?
Hadoop Distributed File System: Introduction
High-level Architecture
Deep Dive
Anatomy of a Read Operation
Anatomy of a Write Operation
Data Integrity & Caching
Fault Tolerance
HDFS High Availability (HA)
HDFS Characteristics
Summary: HDFS
Quiz: HDFS
Mock Interview: HDFS
GFS: How to Design a Distributed File System Storage?
Google File System: Introduction
High-level Architecture
Single Master and Large Chunk Size
Metadata
Master Operations
Anatomy of a Read Operation
Anatomy of a Write Operation
Anatomy of an Append Operation
GFS Consistency Model and Snapshotting
Fault Tolerance, High Availability, and Data Integrity
Garbage Collection
Criticism on GFS
Summary: GFS
Quiz: GFS
Mock Interview: GFS
BigTable: How to Design a Wide Column Storage System?
BigTable: Introduction
BigTable Data Model
System APIs
Partitioning and High-level Architecture
SSTable
GFS and Chubby
Bigtable Components
Working with Tablets
The Life of BigTable's Read & Write Operations
Fault Tolerance and Compaction
BigTable Refinements
BigTable Characteristics
Summary: BigTable
Quiz: BigTable
Mock Interview: BigTable
Designing Reddit (medium)
Design Reddit
Quiz
Designing Notification Service (medium)
Designing a Notification System
Quiz
Design Google Calendar (medium)
Design Google calendar (Medium)
Quiz
Design a Recommendation System (medium)
Design a Recommendation System for Netflix
Quiz
Designing Gmail (medium)
Design Gmail
Quiz
Designing Google News (medium)
Design Google News, a Global News Aggregator System (Medium)
Quiz
Designing Unique ID Generator (medium)
Design Unique ID Generator (Easy)
Quiz
Designing Code Judging System (medium)
Design Code Judging System like LeetCode (Medium)
Quiz
Designing Payment System (hard)
Design Payment System
Quiz
Designing Flash Sale System (hard)
Design a Flash Sale for an E-commerce Site (Hard)
Quiz
Designing Reminder Alert System (hard)
Design a Reminder Alert System
Quiz
System Design Patterns
Introduction: System Design Patterns
1. Bloom Filters
2. Consistent Hashing
3. Quorum
4. Leader and Follower
5. Write-ahead Log
6. Segmented Log
7. High-Water Mark
8. Lease
9. Heartbeat
10. Gossip Protocol
11. Phi Accrual Failure Detection
12. Split Brain
13. Fencing
14. Checksum
15. Vector Clocks
16. CAP Theorem
17. PACELC Theorem
18. Hinted Handoff
19. Read Repair
20. Merkle Trees
Quiz
HTTP vs. HTTPS
http
tls
authentication
encryption
+1
You connect to the free Wi-Fi in a coffee shop and log in to a website. Your password leaves your laptop. It passes through the shop's router, an internet provider, and several other networks before it reaches the website.
Who else can read it on the way? The answer depends on one letter in the address bar: whether the address starts with http or https.
This lesson explains what HTTP does, what HTTPS adds, how that protection works, and why almost every website now uses HTTPS.
What HTTP Is
HTTP stands for HyperText Transfer Protocol. It is the set of rules that browsers and servers use to exchange data on the web. When you type a website address into your browser, HTTP is what fetches the page and brings it back.
HTTP works as request and response. The client, usually a browser or an app, sends a request. The server sends back a response.
Here is a simple request for a product page.
GET /products/42 HTTP/1.1
Host: shop.example.com
Accept: text/html
And here is the start of the response.
HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 5120
<html> ... the page ... </html>
A request has a few main parts.
- Method. The action the client wants.
GETreads data,POSTsends new data,PUTreplaces data, andDELETEremoves it. - Path. Which resource the client wants, like
/products/42. - Headers. Extra information as name and value pairs, like
HostorAccept. - Body. Optional data, like the fields of a form.
A response starts with a status code, a three-digit number that says what happened. Codes in the 200s mean success, like 200 OK. Codes in the 300s usually mean the resource moved, like 301 Moved Permanently. Codes in the 400s mean the client made a mistake, like 404 Not Found. Codes in the 500s mean the server failed, like 500 Internal Server Error.
HTTP Is Stateless
HTTP is stateless. Each request from a client to a server is independent. The server does not keep any session information between requests.
So how does a website remember that you logged in? It uses a cookie, which is a small piece of data that the server asks the browser to store. After you log in, the server sends a session ID in a cookie. The browser then sends that cookie with every later request, and the server uses it to recognize you.
HTTP Sends Plain Text
HTTP sends data as plain text, with no encryption. Every request, header, and form field travels in a form that anyone can read. HTTP uses port 80 by default.
In the coffee shop, this is the problem. Anyone who can see the traffic can read your password. That includes a person on the same Wi-Fi, the shop's router, and every network between you and the server. They can also change the page on its way to you, for example to add a harmful script.
What HTTPS Adds
HTTPS stands for HyperText Transfer Protocol Secure. It is HTTP with a security layer called TLS (Transport Layer Security) underneath. The requests and responses are the same. Only the way they travel changes. HTTPS uses port 443 by default.
You will often see the name SSL/TLS. SSL was the older version of this security layer. All versions of SSL are now outdated and unsafe, and modern HTTPS uses TLS. The old name stayed in use, so people still say "SSL certificate".
TLS gives HTTPS three guarantees.
- Encryption. The data is scrambled with a secret key. Anyone who intercepts it sees only unreadable bytes.
- Authentication. The browser checks that it is really talking to the site it asked for. This prevents a man-in-the-middle attack, where an attacker intercepts the traffic between you and the server and pretends to be the server.
- Integrity. Any change to the data on the way is detected, so nobody can alter it without being noticed.
Authentication does work that encryption cannot do alone. An encrypted conversation with an attacker who pretends to be your bank protects nothing. The attacker simply decrypts everything you send.
How HTTPS Works
Before any HTTP data moves, the browser and the server run a TLS handshake. The handshake checks who the server is and creates a secret key for the conversation. Here are its main steps, simplified.
- The browser says hello. It lists the encryption methods it supports and sends the first part of a key exchange.
- The server replies. It picks an encryption method, sends its part of the key exchange, and sends its certificate.
- The browser checks the certificate. It confirms that a trusted authority signed it, that it has not expired, and that it matches the domain name.
- Both sides create the same secret key. Each side uses the key exchange to calculate the same key. The key itself never travels across the network.
- Encrypted HTTP begins. Every request and response is now encrypted with that key.
With TLS 1.3, the current version, this handshake needs only one round trip between browser and server.
Two Kinds of Encryption
HTTPS uses two kinds of encryption because each one is good at a different job.
- Public-key encryption uses a pair of keys: a public key that anyone may see, and a private key that the owner keeps secret. It lets two sides agree on a secret key over a network that others can watch. But it is slow.
- Symmetric encryption uses one shared secret key for both encrypting and decrypting data. It is very fast, but both sides must already have the same key.
So HTTPS uses public-key encryption once, during the handshake, to agree on a key. Then it uses fast symmetric encryption, like AES, for all the data.
Certificates
A certificate is a digital document that proves a server owns a domain name. It contains the domain name, the server's public key, and an expiry date.
A certificate authority (CA) is a trusted organization that checks domain ownership and signs certificates. Browsers and operating systems come with a built-in list of CAs they trust. When a certificate is signed by one of them, the browser accepts it.
If an attacker intercepts the connection, they cannot show a valid certificate for your bank's domain. No trusted CA will sign one for them. So the browser shows a warning instead of connecting.
Certificates expire, so servers must renew them. Free CAs, like Let's Encrypt, issue certificates that last 90 days, and most teams renew them automatically.
Is HTTPS Slower?
HTTP is slightly faster because it does no encryption work. HTTPS is slightly slower because of the handshake and the encryption itself.
Today the difference is small, for three reasons.
- Modern processors have built-in support for encryption, so encrypting data costs very little.
- TLS 1.3 needs only one round trip for the handshake. A returning browser can also resume an earlier session and skip part of the work.
- One connection is reused for many requests, so the handshake does not repeat for each request.
HTTPS can even make sites faster. Browsers support the newer HTTP/2 protocol only over HTTPS, and HTTP/2 loads pages with many files more quickly.
Why HTTPS Became the Standard
For any site where users enter passwords, card numbers, or bank details, HTTPS is essential. But today it is used on almost every site, for more reasons than encryption.
- User trust. Browsers show a padlock icon for secure connections. They mark sites that use plain HTTP as "Not secure", so users trust them less.
- Search ranking. Search engines rank secure sites slightly higher, so HTTPS helps people find a site.
- Compliance. Many laws and industry rules require user data to be protected while it travels.
- Modern features. Many browser features, like HTTP/2 and location access, work only over HTTPS.
Most sites still listen on port 80, but only to redirect. A request to http:// gets a 301 response that points to the https:// address. Sites can also send an HSTS header (HTTP Strict Transport Security), which tells the browser to use HTTPS for that site every time.
| HTTP | HTTPS | |
|---|---|---|
| Security | None, plain text | Encrypted with TLS |
| Default port | 80 | 443 |
| Server identity | Not checked | Checked with a certificate |
| Performance | Slightly faster | Slightly slower, now a small difference |
| Search ranking | Lower | Higher |
| Good fit | Local testing only | Every public website and API |
What HTTPS Does Not Protect
HTTPS protects the content of the traffic. It does not hide everything.
- The domain name is usually visible. The network can still see that you visited
shop.example.com, from the DNS lookup and the start of the handshake. It cannot see the path, like/orders/42. - The IP addresses, timing, and amount of data are visible.
- HTTPS does not make a site honest. A fake login page can also have a valid certificate for its own domain. The padlock only means the connection is private, not that the site is safe.
HTTPS Inside a System
In a large system, HTTPS often ends at the load balancer, the server that spreads incoming requests across many app servers. This is called TLS termination. The load balancer holds the certificate, decrypts the traffic, and forwards the requests to the app servers.
This saves work on the app servers, and it keeps certificates in one place. Many teams also encrypt the traffic between their own servers. The network inside a data center may not be private, and TLS stops an attacker from pretending to be one of the services.
Key Takeaways
- HTTP (HyperText Transfer Protocol) moves data on the web as requests and responses. It is stateless, sends plain text, and uses port 80.
- HTTPS is HTTP over TLS, on port 443. It adds encryption, authentication, and integrity.
- Authentication, through certificates signed by trusted CAs, prevents man-in-the-middle attacks.
- TLS uses public-key encryption during the handshake to agree on a key, then fast symmetric encryption for the data.
- HTTPS is slightly slower than HTTP, but the difference is small today.
- HTTPS is essential for sensitive data, and it also brings user trust, better search ranking, and compliance.
- HTTPS hides the content of traffic, but not the domain name, IP addresses, or data size.
HTTP defines what a request and a response look like. HTTPS stops others from reading or changing them on the way. The next lesson, TCP vs. UDP, goes one layer down, to the protocols that actually carry these messages across the network.
Practice Questions
Try each question first, then open the answer.
1. A login page uses HTTP, and a user logs in on public Wi-Fi. What can an attacker on the same network do?
<details> <summary>Show answer</summary>Read the password and change the page. HTTP sends plain text, so the username and password are readable to anyone who sees the traffic. The attacker can also change the response on its way to the user, for example to add a harmful script. HTTPS prevents both, with encryption and integrity checks.
</details>2. Why does HTTPS need authentication? Would encryption alone not be enough?
<details> <summary>Show answer</summary>Encryption alone does not tell you who is on the other end. An attacker could pretend to be the server and set up an encrypted connection with you. Everything would be encrypted, but the attacker would decrypt and read it. The certificate check proves the server owns the domain, which stops this man-in-the-middle attack.
</details>3. A browser shows a warning that a site's certificate is not valid. Name two likely causes.
<details> <summary>Show answer</summary>Common causes are an expired certificate and a domain mismatch. Certificates have an expiry date, and a team may forget to renew one. A domain mismatch happens when a certificate for one name, like www.example.com, is used on another, like shop.example.com. A third cause is a certificate that no trusted certificate authority signed.
4. Which ports do HTTP and HTTPS use by default? What does a modern site usually do with a request that arrives on port 80?
<details> <summary>Show answer</summary>HTTP uses port 80, and HTTPS uses port 443. A modern site answers a request on port 80 with a 301 redirect to the https:// address. It can also send an HSTS header, so the browser uses HTTPS for that site every time from then on.
5. An employee visits a website over HTTPS on the company network. What can the network still see, and what can it not see?
<details> <summary>Show answer</summary>It can see the domain name, the IP addresses, the time, and how much data moved. The domain name is visible from the DNS lookup and the start of the TLS handshake. It cannot see the path of each page, the page content, form data, or cookies, because those are encrypted.
</details>Discussion
On This Page