We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design and AI Engineering, by Roni Das. 984 interactive lessons.
Start LearningFoundation · Load Balancing & Proxies
Load balancing at the application layer (HTTP) that can route based on URL paths, headers, cookies, or request content. More flexible but more CPU-intensive.
In short
Layer 7 load balancing distributes incoming requests across backend servers by reading the actual contents of each HTTP request, including the URL path, headers, cookies, and method, so it can make routing decisions like sending /api traffic to one pool and /images to another. It operates at the application layer of the OSI model, which makes it far more flexible than Layer 4 balancing but uses more CPU because it terminates the connection and parses every request.
In short
Layer 7 load balancing distributes incoming requests across backend servers by reading the actual contents of each HTTP request, including the URL path, headers, cookies, and method, so it can make routing decisions like sending /api traffic to one pool and /images to another. It operates at the application layer of the OSI model, which makes it far more flexible than Layer 4 balancing but uses more CPU because it terminates the connection and parses every request.
Learn it in the course
This page is the free part.
₹1,111 in India$25 everywhere elseonce, for the whole course
The System Design course covers Layer 7 Load Balancing across a run of lessons, not one page. These 4 alone are about 123 minutes of step-by-step reading, every one with a quiz.
Path-based routing for microservices request routing, tested on real nginx, Envoy and HAProxy: nginx location order, ALB path rules, Ingress, path vs host.
Using DNS to distribute traffic across servers, the simplest form of global load balancing.
How a GSLB decides which region a user reaches, and why the decision takes minutes to arrive even when it is made in microseconds.
How traffic actually gets spread across many servers, and what breaks when it does not.
all part of
System Design Masterclass
770 lessons · about 287 hours · 18 free to read
₹1,111in India, by UPI
$25everywhere else, by PayPal
It is really nice and good Please join the course
pay once,
yours for life
A load balancer sits in front of a group of backend servers and decides which server should handle each incoming request. A Layer 7 load balancer makes that decision by looking inside the request itself. It reads the HTTP method, the URL path, the Host header, cookies, query strings, and sometimes the body. This is the application layer, layer 7 of the seven-layer OSI model, which is why it is named that way.
Contrast this with Layer 4 load balancing, which only sees TCP and UDP information: source IP, destination IP, and ports. A Layer 4 balancer cannot tell the difference between a request for /login and a request for /checkout, because to it both are just bytes flowing over the same TCP connection. A Layer 7 balancer reads them as HTTP and can treat them differently.
Because it understands HTTP, a Layer 7 balancer can do things a Layer 4 one cannot: route /api/* to your API servers and /static/* to a cache pool, stick a user to the same backend using a session cookie, rewrite headers, terminate TLS, compress responses, and return a 503 page when every backend is down.
The Layer 7 balancer terminates the client connection. The client opens a TCP connection (and a TLS handshake for HTTPS) with the load balancer itself, not with the backend. The balancer decrypts the traffic, reads the full HTTP request, and only then decides where to send it.
It then opens its own connection to the chosen backend, usually reusing a pooled keep-alive connection so it does not pay the TCP and TLS setup cost on every request. The request is forwarded, the response comes back, and the balancer relays it to the client. Two separate connections exist: client to balancer, and balancer to backend.
Routing rules are evaluated in order. A typical config matches on host and path first, picks a backend pool, then applies a balancing algorithm within that pool such as round robin, least connections, or a hash of a cookie for stickiness. Health checks run continuously so a backend that fails an HTTP probe is pulled out of rotation.
The cost of all this is CPU and a small amount of latency. Parsing HTTP, decrypting TLS, and maintaining two connection sets per request is heavier than the near line-rate packet forwarding a Layer 4 balancer does. In practice the overhead is a fraction of a millisecond per request, which is fine for almost every web workload but matters at very high packet rates.
Reach for Layer 7 when routing depends on what is in the request. Path-based routing for microservices, host-based routing for multi-tenant apps, canary releases that send 5 percent of traffic to a new version, A/B tests keyed on a cookie, and sticky sessions for stateful apps all require Layer 7 visibility.
It is also the natural place to centralize TLS termination, gzip or Brotli compression, request and response header rewriting, rate limiting per path, and web application firewall rules. Putting these at the edge keeps your backend servers simpler.
The trade-off is throughput and complexity. Layer 7 balancers handle fewer raw connections per second than Layer 4 and add a hop of TLS decrypt and re-encrypt. For workloads that do not need request inspection, such as a database proxy or a raw TCP game server, Layer 4 is cheaper and faster. A common pattern is to combine them: Layer 4 at the very front for raw scale and DDoS absorption, Layer 7 behind it for smart HTTP routing.
Imagine an online store on three pools of servers: web frontends, an API service, and an image service. All traffic hits one hostname, shop.example.com, on a Layer 7 load balancer.
A request for GET /products/123 has path /products, so the balancer sends it to the web pool. A request for GET /api/cart matches /api and goes to the API pool. A request for GET /images/shoe.jpg matches /images and goes to the image pool, which may be backed by a cache. One public endpoint, three internal destinations, decided entirely by reading the path.
Now the team ships a new checkout service. They add a rule: route 5 percent of /api/checkout traffic to the new version and 95 percent to the old one. If error rates stay low, they raise it to 100 percent. None of this is possible at Layer 4 because the path is invisible there. This is exactly how an AWS Application Load Balancer or an NGINX or Envoy proxy is configured in production every day.
AWS Application Load Balancer
The ALB is a managed Layer 7 balancer that routes on host and path, supports weighted target groups for canaries, and terminates TLS.
NGINX
Used as a reverse proxy and Layer 7 load balancer with location-based routing, upstream pools, and sticky sessions.
Envoy
Powers service meshes like Istio, doing Layer 7 routing, retries, and traffic splitting between service versions.
Cloudflare
Its load balancing and reverse proxy inspect HTTP requests to route, apply WAF rules, and run as Layer 7 at the edge.
Layer 4 routes using only TCP and UDP information like IP addresses and ports, so it is fast but blind to request content. Layer 7 reads the full HTTP request, including path, headers, and cookies, so it can route based on content but uses more CPU. Layer 4 forwards packets; Layer 7 terminates the connection and parses HTTP.
It adds a small overhead because the balancer must decrypt TLS and parse each HTTP request, usually a fraction of a millisecond per request. For typical web traffic this is negligible. It only becomes a concern at extreme request rates, where Layer 4 forwarding is cheaper.
Yes, and it is one of the main reasons to use it. The balancer holds the certificate, decrypts incoming HTTPS, inspects and routes the plaintext request, then talks to backends over plain HTTP or a fresh TLS connection. This centralizes certificate management and offloads crypto work from backend servers.
They overlap but are not identical. Both operate at Layer 7 and route HTTP requests. An API gateway adds API-specific features like authentication, rate limiting per API key, request transformation, and developer-facing API management. A Layer 7 load balancer focuses on distributing traffic across backends, though modern ones include many gateway-style features.
The balancer either reads an existing session cookie or injects its own cookie identifying which backend served the user. On the next request it reads that cookie and routes to the same backend, so in-memory session state stays available. This is only possible at Layer 7 because Layer 4 cannot see cookies.
Load Balancer
Distributes incoming traffic across multiple servers so no single server gets overwhelmed. Like a traffic cop directing cars to different lanes.
HTTP
The protocol powering the web. A request-response model where clients ask for resources and servers respond. Stateless by design.
Layer 4 Load Balancing
Load balancing at the transport layer (TCP/UDP) based on IP addresses and ports. Fast because it doesn't inspect packet contents.
DNS
The phonebook of the internet. Translates human-readable domain names (google.com) into IP addresses that computers understand.
Proxy
An intermediary server that sits between the client and the destination server. Forward proxies act on behalf of clients; reverse proxies act on behalf of servers.
Reverse Proxy
A server in front of your web servers that receives every request first, passes it to one of them and returns the answer. It handles TLS, load balancing, caching and routing, and hides the servers behind it.
This page explains the idea. The course covers it step by step, with diagrams. It is part of the System Design Masterclass course, which has 770 lessons. 18 of them are free to read. You pay once and keep it for life, with no subscription.
See the System Design Masterclass coursecourse 1
From absolute beginner to principal engineer, drawn step by step.
Asked about Layer 7 Load Balancing in an interview?
Each question has why it is asked, a full answer, what the interviewer listens for, the follow-ups, the common mistakes and a diagram (268 diagrams in all). A PDF you keep, junior to staff level.
India: UPI, cards or netbanking through Razorpay. Elsewhere: card or PayPal. Download at once from My packs.
