Week 9 Mini Project: HTTP Reverse Proxy with Full Observability

Architecture Summary

Client Request
    ↓
┌──────────────────────────────────────────────────┐
│   HTTP Reverse Proxy (H1 + H2, TLS)              │
│                                                  │
│  Middleware Chain:                               │
│  1. PanicRecoverer                               │
│  2. RequestID                                    │
│  3. SecurityHeaders (CSP nonce, CORS, HSTS)      │
│  4. RequestLogger (structured JSON, slog)        │
│  5. UpstreamProxy → Backend health check         │
│                                                  │
│  Metrics Ring Buffer: p50/p95/p99 latency        │
│  Endpoints: /health /debug/vars /debug/pprof     │
└──────────────────────────────────────────────────┘
    ↓
Backend (HTTP :9090)

Engineer Takeaway

Every Nginx, Envoy, and AWS ALB request goes through a chain like this. The middleware ordering is a security architecture decision: PanicRecoverer must be outermost to catch everything; RequestID before Logger so all logs are correlated. CORS misconfigurations are in the OWASP Top 10 every year — your allowlist CORS middleware eliminates the entire class of CORS wildcard vulnerabilities.