Let us try to understand all concepts of scaling web apps with an example.

An organization has a simple resume web app thats allows user to update his profile (name, email, phone ,education ,skills, profile picture , achievements etc) and view resume of the other people.

It was hosted on a single linux machine and using rdms database (mysql), and everything was good in terms of code, but all of a sudden, site traffic increased and the site was very slow and sometimes it caused downtimes.

Let us discuss the necessary actions to be taken as an architect to handle more trafffic. Please proceed for next step only if the previous step is not able to solve the problem of higher latency of website / downtimes as each step introduces more cost.

Add Database Cache (memcache / redis)

Read from database is expensive operation as it takes more time to read from database compared to cache in memory. You can use memcache if you want to go for simple key value cache, otherwise go for the redis.

Add Http Cache (varnish)

Latency of apis are significantly increased, but frontend content is dynamically generated everytime, so add http cache for html page caching with a specific expiry interval and also also enable web browser cache.

e.g Resume gets various values ( education history, skills, experience etc) from many tables (may keys of cache in case of cache hit) and each network call (suppose 3 calls) for each of the different value. But we can cache the page generated with the values so that we can get resume in 1 network call instead of 3 network calls and also we should ensure that cached pages are expired at proper intervals to display almost latest resume.

Load balancing

It is easier said than done, but involves a lot of pre analysis of app before doing load balancing. Load balancing involves routing traffic to various instances, adding/removes of instances based on certain parameters. The most common load balancing methods include round robin, api path, weighted traffic , geo location , least connections , least response time, IP hash etc.

Pre Analysis of web app and solving the problems so that web app is ready for load balancing

a. Find and move out all the write operations in the web app instance to a object storage or nfs mounted on the seperate app instance.

In resume web app , we find profile pictures and theme templates are stored on the instance itself. If you have limited time and want to achieve without changing app code, then you can move all the profile pictures, theme templates to other instance with nfs server, and mount nfs on web app instance, otherwise modify the code to storage images/templates on object storage (s3 or google bucket).

Also, logs are stored on the instance itself, so you can use ELK ( Elastic Search , LogStash and Kibana ) or aws cloud watch or google stackdriver logging for pushing, searching and analyzing logs.

But why should we avoid write operations to instance ?

As load balancer involves selecting one of the instance for a particular request , the write operation data on one instance might not be available for read as other request may access other instance.

e.g. uploading profile picture request goes to instance 1 and gets stored on it, but view profile request goes to instance 2 leading to the error of profile picture being not found, so we should store profile pictures on a common storage(nfs or object storage) that can be accessed by instance 1,2,….N.

Also, during downscaling which happens when site traffic reduces , then written data is lost forever. Also, add nfs mounting on startup of a instance.

b. Move databases / database cache to a sepeate common instance for all autoscaled app services or use them as a service such as aws rds / google cloud sql etc. with read replicas , sharding and db internal partitions.

Ideally we want same database for autoscaled services, and also don’t want to get lost of the database hosted on app instance during downscaling. Enable read replicas to reduce load on master database. We will discuss more about sharding , partitioning in other article in much more detail.

c. Ensure that memcache/redis to a new instance which is not under auto scaling of web app instance

same reason as above

d. Find and move out all the crons/schedulers in the web app instance to a new instance which is not under auto scaling of web app instance

You need to do this to avoid duplicate execution of same crons on different autoscaled instances.

Interceptors in the web application are the components that intercepts calls during request/response cycle. Usually these are executed after every request/response. Most common examples include ip filtering, authorization of user roles, logging important data of request/response, api rate limiting, adding extra request/response headers, preventing DDoS attacks, redirecting requests to other services in api gateway etc.

During software development stage, we developers usually face lot of errors/exceptions and do google search for the same and mostly endup in stackoverflow or other sites and check the answer with more votes. What if we can catch the error/exception in response interceptor, call the stackoverflow or other website api to get the most relevant top voted results and display to the developers ?

It is fun right !!!

Obviously Yes. Developers can save lot of time, and no manaul copy-paste job.

Luckily, stackoverflow provides an rest api for searching various errors/exceptions/info on many topics.

Below example searches for Unsupported major.minor version of java and sorts the results by votes in descending order of pagesize 2.

https://api.stackexchange.com/docs/search#pagesize=2&order=desc&sort=votes&tagged=java&intitle=Unsupported%20major.minor%20version&filter=default&site=stackoverflow&run=true

{
  "items": [
    {
      "tags": [
        "java",
        "jvm",
        "incompatibility",
        "unsupported-class-version"
      ],
      "owner": {
        "reputation": 19938,
        "user_id": 898042,
        "user_type": "registered",
        "accept_rate": 57,
        "profile_image": "https://i.stack.imgur.com/3QYVI.jpg?s=128&g=1",
        "display_name": "ERJAN",
        "link": "https://stackoverflow.com/users/898042/erjan"
      },
      "is_answered": true,
      "view_count": 1879973,
      "protected_date": 1411403422,
      "accepted_answer_id": 11432195,
      "answer_count": 51,
      "score": 1576,
      "last_activity_date": 1588697101,
      "creation_date": 1335785304,
      "last_edit_date": 1553323320,
      "question_id": 10382929,
      "content_license": "CC BY-SA 4.0",
      "link": "https://stackoverflow.com/questions/10382929/how-to-fix-java-lang-unsupportedclassversionerror-unsupported-major-minor-versi",
      "title": "How to fix java.lang.UnsupportedClassVersionError: Unsupported major.minor version"
    },
    {
      "tags": [
        "java",
        "applet",
        "version",
        "unsupported-class-version"
      ],
      "owner": {
        "reputation": 6333,
        "user_id": 3397452,
        "user_type": "registered",
        "accept_rate": 50,
        "profile_image": "https://www.gravatar.com/avatar/00cc40c22dfcd44184a0639cc0435271?s=128&d=identicon&r=PG&f=1",
        "display_name": "user3397452",
        "link": "https://stackoverflow.com/users/3397452/user3397452"
      },
      "is_answered": true,
      "view_count": 1593229,
      "protected_date": 1434929462,
      "closed_date": 1468997244,
      "answer_count": 26,
      "score": 620,
      "last_activity_date": 1544975419,
      "creation_date": 1395171648,
      "last_edit_date": 1484412305,
      "question_id": 22489398,
      "link": "https://stackoverflow.com/questions/22489398/unsupported-major-minor-version-52-0",
      "closed_reason": "Duplicate",
      "title": "Unsupported major.minor version 52.0"
    }
  ],
  "has_more": true,
  "quota_max": 10000,
  "quota_remaining": 9980
}

You can add code related to http request to any site (stackoverflow or anysite which exposes an api) in response interceptor , iterate through results and display it. As most of the api services have a rate limit, you can store error and their results in db and cache for more optimiazation and only enabled for development environment.

Apart from all the email with + is more valuable in filtering your emails. The text before + is your actual email id and you can write anything after + ,say dora+nitw@gmail.com or dora+twitter@gmail.com .

Why this feature offered ?
Consider, you sign up for a subscription where you know they will ask you to verify and your are sure that you will receive a lot of spam thereafter. At this kind of situations you can give ur email + anything@gmail.com and use your messaging service settings to filter out the mails received by the different addresses accordingly.
But you cannot use the instances of the emails described above to sign in to your account .

Other Posts

Web Security

https://medium.com/@devendradora/security-vulnerability-more-than-1-query-param-with-the-same-name-key-1c6c37f6483d

https://medium.com/@devendradora/a-simple-security-vulnerability-480ae3d6a6d0

Software engineering

https://medium.com/@devendradora/quick-guide-for-a-software-engineer-a52253ee5395

Careers, Startups, Freelancing

https://medium.com/@devendradora/career-startups-corporate-freelancing-733dd6bd2920

Have you ever tried passing same query param in http request ?

e.g 127.0.0.1/webapp?emailId=dev@gmail.com&emailId=dora@gmail.com

Any guess forw hich param would be considered .

Does it depend upon on type of webserver or web application code logic ?

Let us try putting same query param on popular search engines like google and bing and see the result.

https://www.google.co.in/search?q=devendradora&q=india

It searched for devendradora india

https://www.bing.com/search?q=devendradora&q=india

It searched for india

Surprised !!!

There is no such particular standard which defines which parameter to consider if there is a same occurence of the same param. So different webservers treat them differently. Some take the last occurence , others take first occurence and few others take concatenation of both values.

Infact, it depends on type of application server (Apache , IIS , Jetty etc) used.

At first glance, you may think that there is no problem based on which parameter is considered by your web app business logic.

But let me give a simple example of password reset using email.

e.g

Suppose url for password reset is

127.0.0.1/webapp/passwordReset?emailId=dev@gmail.com&userId=1

But attacker modified the url as below with email occuring twice

127.0.0.1/webapp/passwordReset?emailId=dev@gmail.com&emailId=dora@gmail.com&userId=1

Suppose you have 2 different microservices

a. Microservice1 (Server Type X : Takes last occurence of same named param)

Generates a unique password reset link and stores in database. So in the above example it takes dora@gmail.com as emailId param and generates a unique link for userId 1

b. Microservice2 (Server Type Y : Takes first occurence of same named param)

Send email containing password link to query param emailId given in request by taking the value stored by Microservice1 in database.

So in the above example it takes dev@gmail.com as emailId param and sends password reset link of dora@gmail.com (userId =1 in query param ] to dev@gmail.com

By the above example, it is clear that you can reset the password of any user by changing request query param.

This is simple example of what can go wrong if business logic is not implemented properly.

Similary , there can be many vulnerabilities.

Other posts on security :

https://medium.com/@devendradora/a-simple-security-vulnerability-480ae3d6a6d0

Let us take few variables like redeemAmount (comes from client app) , walletBalance.

Logic for deducting amount :

walletBalance = walletBalance-redeemAmount

At first glance the logic seems to be correct , but what if client app send -ve redeemAmount ( i.e., walletBalance=walletBalance-(-redeemAmount) )

Instead of deducting balance , it adds balance . So even substraction operation matters a lot.

So you need to check if redeemAmount is +ve before actual operation for deducting wallet balance takes place.

Hope you will take care of even simple operations in coding from next time.

But, why it happens ?
The files which appeared to be disappeared were moved to a folder named space like character (which can be obtained by typing Alt+255 or Alt + 0160) which is different from space generated by pressing space bar (This space cannot be used to name a folder as folder name doesn’t contain spaces) and the graphical view of folder usually yellow is changed to white which in turn makes the folder invisible. Finally, You need to type *.* in the search as * is a wildcard character which stands for multiple characters in windows platform.

For recovering lost files , you can TestDisk software utility (https://www.cgsecurity.org/wiki/TestDisk) or some of the recovering utilities of Hiren’s Boot cd (https://www.hiren.info/pages/bootcd)

This post describes of basic installation of XAMPP in windows and Linux.
If there are any problems in installation
Visit https://medium.com/@devendradora/handling-problems-in-installation-of-xampp-4eda3634a25e

Setting up of environment

1) Download the software from https://www.apachefriends.org/index.html
** You can find the software for most of the os like linux based (ubuntu,fedora) ,Windows , OSX etc. (For 32 bit systems choose x86 file and x64 file for 64 bit systems)

For windows OS
2) Once your download is complete, install the program, click on Run.

3) Accept the default settings and click on NEXT ….and then on Finish.

4) Now open Xampp control panel .

5) Start the Apache and MySQL . You can also start the other components, if you want to use them.

6) Open any webbrowser(Mozilla , Chrome ,opera) and type localhost or 127.0.0.1 in the address bar .

7) A page appears that offers you to choose language . Click on the language of your preference.

8) Welcome page of xampp is displayed.

For Linux based OS

2) Once your download is complete, navigate to the location of your downloaded file saythe file name is xampp-linux-x64–5.6.3–0-installer .
If your system is dual boot with windows make sure that you move the downloaded file to the location which is only used by linux as there may be some permission issues if it is in shared location of windows and linux.

Open terminal (CTRL + ALT + T for ubuntu) and change your directory to specified location . For e.g cd Downloads

3) Make the file executable
sudo chmod +x xampp-linux-x64–5.6.3–0-installer
**sudo means root access ,+x means executable

4) sudo ./ xampp-linux-x64–5.6.3–0-installer

5) Accept the default settings and click on NEXT ….and then on Finish.

6)To start Xampp (basically called lampp in linux)

sudo /opt/lampp/lampp start

7) Open any webbrowser(Mozilla , Chrome ,opera) and type localhost or 127.0.0.1 in the address bar .

8) A page appears that offers you to choose language . Click on the language of your preference.

9) Welcome page of xampp is displayed.

Problems in installation of XAMPP ?
Visit https://medium.com/@devendradora/handling-problems-in-installation-of-xampp-4eda3634a25e

If everthing goes fine until now then you have installed XAMPP successfully.

For Windows OS
a) Navigate to installation directory of Xampp and open htdocs.
eg. c:/>xampp/htdocs
** htdocs : It is the location where you can place your various web projects.

b) Create a folder named say webdev

c) Create a sample html or php file say login.php or login.html

d) Open web browser and type
localhost/webdev/login.php or 127.0.0.1/webdev/login.php in the address bar
e)Your web page gets displayed.

For Linux OS

a) Navigate to installation directory of Xampp and open htdocs.
eg. open terminal CTRL+ ALT + T and then type following commands

cd /opt/lampp/htdocs

** htdocs : It is the location where you can place your various web projects.

b) Create a folder named say webdev
mkdir webdev
cd webdev

c) Create a sample html or php file say login.php or login.html

d) Open web browser and type
localhost/webdev/login.php or 127.0.0.1/webdev/login.php in the address bar . If access denied then in the terminal , type
chmod +755 webdev

e) Your web page gets displayed.

Apache shutdown unexpectedly.
This may be due to a blocked port, missing dependencies.
Most of the times these errors are due to the same port (Default :80) is used by some other services say Internet Information Services (IIS) ,Skype etc.

Possible solutions :

So either these services can be turned off or port of the apache should be changed to solve the above the problems.

Method1 :
Steps :
-> Open your xampp control panel then click its “config”
-> Choose the “Apache (httpd.conf)” and find this code below and change it into this one:
# change this to Listen on specific IP addresses as shown below
# to prevent Apache from glomming onto all bound IP addresses.
# Listen 0.0.0.0:80
# Listen [::]:80
Listen 80
-> Save it (ctrl + s)
-> Click again on config
-> Choose “Apache (httpd-ssl.conf)” find this code below and change it again:
# Note: Configurations that use IPv6 but not IPv4-mapped addresses need two
# Listen directives: “Listen [::]:443” and “Listen 0.0.0.0:443”
# Listen 0.0.0.0:443
# Listen [::]:443
Listen 443
-> Save it (ctrl + s)

Method 2 : Change the port 80 to some other port say 81
steps :
-> Open your xampp control panel then click its “config”
-> Choose the “Apache (httpd.conf)”
-> Change line
Listen 80 to Listen 81
-> Change line
ServerName localhost:80 to ServerName localhost:81
-> Start the apache

Method 3 : Turning off the IIS server
Steps :
-> Go to the “control panel” -> “Programs & Features” -> “Turn Windows On or Off”.
-> Uncheck your “Internet Information Services” then click ok.

Method 4 : Install on any Virtual Machine ( vmware,virtualbox etc)

Hope this works !!!

Some of the best practices to be followed are as follows :

• Keep reading existing software source code. I know reading and understanding existing source code is boring, but it gives you a chance to know the best practices followed by most of the software developers. Poorly written source code teaches you to write good source code, provided you take it positively and learn a lesson from it. If you want to be a novelist, can you write best novels without reading any of the novels ? I would say NO. Similarly , if you want to write best source code ,then how will it be possible for you to write without reading tons of source codes and know the best practices (Indentation, Comments etc).
• Document your code.
• Test your code properly.
• Keep on learning new things and leave the Ego behind. New technologies are coming everyday and no one have complete command on all things. So feel free to ask/help your colleagues, friends and even juniors.
• It depends on you whether you want to sustain (not adopting to learn new things) or want hikes in career growth.
• Keep yourself updated with latest tools and technologies.
• Participate in Hackathons, Coding competitions, even if you don’t know anything. Winning and losing are part of the game, but the learning and experience gained will be forever.
• Start doing as many projects as possible.

Websites : Stackoverflow, w3schools, tutorialpoint, coursera, edx, udacity, thenewboston, HackerEarth, HackerRank, Spoj, Codechef, interviewbit.

Blogs :

Explore the new world of computers,mobiles, technology & science

THE NEW WORLD OF PROGRAMMING

Hacking Protect

Engineering Projects in Community Service

want to become rich ?

No doubt that you will earn a lot of money, but will you be able to sleep properly, enjoy with your family. Remember you go empty handed when you leave the world.

want to earn money that can lead you a work-life balance and some savings for future ?

Let us explore into startups

Joining new Startups

Pros

• Huge learning curve.
• Chances in involving in almost all phases ( Dev , Testing , Devops , Sales , Management).
• Options of more stock.

Cons

• Chances of Firing and chances of getting other jobs becomes difficult if you have no prior experience in some well known companies.
• Company may shutdown.
• Only nominal % of startups succeed.
• Less package during initial phase.
• Less work life balance.
• No proper well established coding or other standards at initial stages

Want to start your own startup ?

Becoming “ Boss/CEO “ seems to be attractive as glory, power, money comes along with.

But there are several disadvantages to consider

• Hard to sleep properly.
• No work life balance.
• You might have a lot of talent, but always stick to excel sheets at later stage.
• No well established coding and other standards.

But above disadvantages can be nothing if you have proper planning .

Other option would be “Do a startup, make it grow and sell it when you feel like enjoying life “ . The money will be suffice to lead a better life , but you can choose freelancing or join as a adviser to some company or can join corporate company.

Start a startup in early school/college days

Pros

• No need of paying developers (friends) as most of them want to learn or do many projects at this stage.
• No need of investment in office infrastructure

Cons

• More chances of failure, but lessons learnt from them will be a great asset.
• School/college Grades may decrease.
• Scalability problems.
• Less investment of money due to no income, but you can approach venture capitalists.
• Miss a lot of enjoyments in college life

Starting a startup post college

Pros

• You are the boss.
• Huge profit if it succeeds

Cons

• May fail if u have no proper plans, goals, investment, sales and marketing.
• No work life balance at initial phase.
• May Not able to hire highly talented people due to financial problems.
• If you are working full-time, you may go out of money due to no income , investment in office infrastructure and travelling costs at initial stage.

Now Let us have a look at other options.

Freelancing

Pros

• Flexible working hours.
• Work whenever you want.
• You are the boss.
• Work on the projects you like.
• Huge learning Curve.

Cons

• Income and work load are inconsistent.
• No employee benefits.
• You may not find projects all the time.

Joining corporate companies

Pros

• Good work life balance in most of the companies.
• More job security compared to startups

Cons

• More levels of hierarchy in the job roles and usually it takes more time to promoted to next higher level
• Less hikes

Joining Govt. sector jobs

Pros

• Healthier work life balance.
• Much More job security.

Cons

• Less Learning curve.
• Promotion comes with experience, but not perfomance.
• Average pay

Considering all the above scenarios, I recommend you to go for corporate companies for first few years to learn best coding standards, industry practices and have some well known company on your resume. Then you can choose startups or freelancing.

*** In corporate companies, it usually takes 2–4 years for going to next level unlike the startups which usually depends your performance and the time you joined startup.