Layer 7 Load Balancing

Unlike lower-layer balancers, a Layer 7 load balancer examines the actual content of HTTP/HTTPS requests. This enables routing decisions based on:

• URL paths (e.g., /api/v1/ to one server pool, /static/ to a CDN)
• HTTP headers (e.g., User-Agent to direct mobile traffic)
• Request methods (e.g., POST vs. GET)
• Query strings and cookies This granularity allows for optimal placement of requests based on the application's needs, not just network-level information.

A core capability is terminating encrypted SSL/TLS sessions at the load balancer. This offloads the computationally expensive decryption/encryption process from backend servers. Benefits include:

• Improved backend performance: Servers process plain HTTP.
• Centralized certificate management: SSL certificates are installed and renewed only on the load balancer.
• Enhanced security inspection: Traffic can be analyzed for threats (e.g., DDoS, SQLi) in its decrypted state before being passed to the application.

Ensures all requests from a user session are directed to the same backend server, which is critical for stateful applications. Layer 7 balancers achieve this using application-layer identifiers:

• Injecting and reading custom cookies
• Tracking HTTP session IDs
• Using JWT tokens in authorization headers This is more reliable than Layer 4 persistence (based on IP), which can fail if a user's IP changes or multiple users share an IP (NAT).

Performs deep, application-specific health checks beyond simple TCP port connectivity. The balancer can:

• Send an HTTP GET request to a specific endpoint (e.g., /health).
• Validate the HTTP status code (e.g., require a 200 OK).
• Parse the response body for a specific string or JSON value.
• Monitor for slow response times that indicate a degraded server. This ensures traffic is only sent to servers that are truly capable of handling application requests correctly.

Can modify requests and responses in transit, acting as a powerful application intermediary. Common transformations include:

• Header insertion/modification: Adding X-Forwarded-For headers or stripping internal server headers.
• URL rewriting: Redirecting or modifying paths before they reach the backend.
• Response compression: Gzipping content on the fly to reduce bandwidth.
• A/B testing: Routing a percentage of traffic to a different backend based on a cookie or header.

Serves as a strategic choke point for applying security policies uniformly across all backend services. Key functions include:

• Web Application Firewall (WAF): Inspecting traffic for OWASP Top 10 vulnerabilities.
• Rate limiting and throttling: Enforcing quotas per API key, IP, or user.
• Bot management: Identifying and blocking malicious crawlers.
• Authentication & Authorization: Verifying JWT tokens or integrating with identity providers before requests reach the application.

This is the foundational use case. A Layer 7 load balancer (Application Load Balancer) inspects incoming HTTP/HTTPS requests and routes them based on content.

Key routing criteria include:

• URL Path: Direct /api/ requests to an API server pool and /static/ requests to a CDN or object storage.
• HTTP Headers: Route traffic based on Host header for virtual hosting, User-Agent for mobile vs. desktop versions, or custom headers for A/B testing.
• HTTP Method: Send POST requests to write-optimized backends and GET requests to read-optimized caches.

Example: An e-commerce site routes /checkout POST requests to a secure, high-availability transaction service cluster, while product image requests (/images/*) are routed to a high-throughput object storage backend.

In a microservices architecture, a Layer 7 load balancer acts as an intelligent API gateway, directing requests to specific services based on the API endpoint.

Core functions include:

• Service Discovery & Routing: Maps request paths like /users/* to the user-service cluster and /orders/* to the order-service cluster.
• SSL/TLS Termination: Offloads decryption/encryption overhead from individual microservices, centralizing certificate management.
• Request/Response Transformation: Modifies headers (e.g., adding authentication tokens) or aggregates responses from multiple services.

Example: A request to api.example.com/v1/inventory/check is parsed; the /inventory path prefix routes it to the inventory microservice pool, while the load balancer handles authentication validation via a JWT in the header before forwarding.

Layer 7 load balancers enable session affinity by inspecting application-layer data to keep a user's session on the same backend server.

Methods for maintaining stickiness:

• Cookie-Based: The load balancer injects its own cookie (e.g., AWSALB) or uses the application's session cookie (e.g., JSESSIONID) to identify and route subsequent requests.
• Header-Based: Uses a consistent header value, like a user ID, to determine routing.

Why it's critical: Certain application states, like items in a shopping cart or in-memory user data, are often stored locally on a server. Sticky sessions prevent errors and data loss by ensuring continuity. Without it, a user's next request might land on a server without their session data.

The deep packet inspection capability of Layer 7 load balancing allows for sophisticated traffic control and security filtering at the application edge.

Key applications include:

• A/B Testing & Canary Deployments: Route a percentage of traffic (based on cookie or header) to a new application version for testing.
• Rate Limiting & Throttling: Enforce request limits per API key, IP address, or user to prevent abuse and ensure fair usage.
• Security Filtering: Block requests with malicious patterns in the URL (SQL injection, path traversal) or suspicious headers before they reach the application servers.
• Bot Mitigation: Identify and redirect non-human traffic based on request patterns and headers to a separate handling path or challenge service.

Layer 7 load balancers optimize performance and cost by routing requests to the most appropriate backend based on the request's content type and requirements.

Implementation examples:

• Image/Video Optimization: Route requests for media assets (*.jpg, *.mp4) to a dedicated optimization service that resizes, compresses, or converts formats before delivery.
• Dynamic vs. Static Content: Send requests for dynamic pages (requiring database queries) to application servers, while static assets (CSS, JS, fonts) are routed directly to a high-performance CDN or cache.
• Geolocation & Localization: Redirect users to a region-specific endpoint or language version of a site based on their IP address or Accept-Language header.

Beyond basic HTTP, Layer 7 load balancers understand application protocols, enabling intelligent handling of modern web communication patterns.

Critical for real-time applications:

• WebSocket Connection Routing: Inspects the initial HTTP Upgrade header to establish a WebSocket connection and ensures all subsequent frames for that connection are routed to the same backend server, maintaining the stateful, bidirectional channel.
• gRPC & HTTP/2 Support: Can parse HTTP/2 frames and gRPC metadata (contained in headers) to perform advanced routing, load balancing, and health checks for modern RPC-based microservices.
• Protocol Upgrades: Manages the handshake for switching protocols (e.g., from HTTP/1.1 to HTTP/2 or WebSockets) and maintains correct routing post-upgrade.

Layer 4 Load Balancing operates at the transport layer (TCP/UDP) of the OSI model. It makes routing decisions based on network-level information:

• Source/Destination IP Address
• TCP/UDP Port Numbers Unlike Layer 7, it cannot inspect the content of the message. This makes it faster and lower latency, ideal for non-HTTP protocols like database traffic, gaming, or VoIP. It is often used for Network Load Balancers (NLBs).

Session Persistence, or Sticky Sessions, is a feature where a load balancer directs all requests from a specific user session to the same backend server. This is critical for stateful applications where user session data is stored locally on a server. Layer 7 load balancers achieve this by inspecting and setting:

• HTTP Cookies (inserted by the load balancer)
• JWT Tokens or other authorization headers Without persistence, users could lose their session state if bounced between different backend instances.

A Health Check is a periodic probe sent by a load balancer to backend servers to determine their operational status. For Layer 7, these checks are application-aware:

• HTTP GET Request: To a specific endpoint (e.g., /health).
• Status Code Validation: Expecting a 200 OK response.
• Response Time Thresholds: Marking a server unhealthy if responses are too slow. Failed health checks automatically trigger the load balancer to stop sending traffic to that instance, ensuring high availability.