The response and delivery
Capstone: trace a request end to end
Combine everything in one scenario: design a feature and justify your decisions at every layer.
Understand the concept
In this capstone you design a small but realistic feature: a ‘like’ button for blog posts. Visitors can like a post, the like count shows on the post page, and the same person cannot like the same post repeatedly. The goal is less about writing code than making the right decision at every stop of the request.
For each layer ask yourself these questions. Browser: is the button a client component, is the count rendered on the server, what does the interface show while the request is in flight? Edge and frontend: which path does this POST take, what protects it against CSRF? API: which method and status code, which validation, which rate limit? Identity: how is an anonymous visitor de-duplicated? Data: what is the table structure, how does the database itself prevent the same person liking twice, how is counting kept fast? Cache: if the count is cached, how is it updated? Resilience: are two simultaneous likes counted correctly, what does the user see when something fails?
After writing your answers, replay the simulator scenarios and mark where your design lands at each step. A good design is one where every layer does its own job and no layer assumes another’s security.
Knowledge shows not in isolated concepts but in combining them correctly.
De-duplicating only in the interface by disabling the button.
A letter’s journey through the city
Think of a request as a letter and the server as a city. Pick a scenario, press play and watch which gates the letter passes and where it gets stopped.
You clicked a post. The browser writes a letter saying ‘send me this post’.
One topic. Three levels of depth.
POST /api/posts/ilk-yazi/likes
→ 201 Created { "likes": 43 } (ilk beğeni)
→ 200 OK { "likes": 43 } (zaten beğenmiş: idempotent)Repeating the same request does not change state; retrying is safe.
This page connects to no real server or database. Code samples are illustrative for .NET 8, Next.js and SQL Server; timings are example values in the simulation, not measurements. Try samples only in your own development environment; never share real connection strings, tokens or passwords.
Try it yourself first.
Summarise your design in one paragraph: the request path, the protection at each layer and de-duplication in the database. Then answer ‘what happens if a bot sends 10,000 likes per minute?’
Show the solution and explanation
Örnek cevap:
Tarayıcıdaki istemci bileşeni aynı kökendeki route handler’a POST eder (Origin kontrolü);
API IP başına hız sınırı uygular (ör. dakikada 30), girdiyi doğrular,
PostLikes tablosundaki birleşik birincil anahtar tekrarı engeller, sayaç önbellekte güncellenir.
Bot: çoğu istek hız sınırında 429 alır; geçenler aynı ziyaretçi kimliğiyse kısıta takılır;
farklı kimlikler üretiyorsa ek sinyaller (CAPTCHA eşiği, kimliği doğrulanmış beğeni) gerekir.No single layer is enough; defence and correctness come from the layers working together.