Context-Aware Routing
Layer 7 load balancing is like a hotel concierge who reads your request, understands what you need, and routes you to the right department — the restaurant, the spa, or the business center — based on the content of your request, not just your room number.
Layer 7 (Application Layer) load balancing operates at the level of HTTP/HTTPS requests. The sequence is fundamentally different from L4:
- The client connects to the LB and completes a full TCP handshake.
- TLS Termination: If the connection is HTTPS, the LB performs the TLS handshake, decrypts the traffic using its own certificate, and reads the plaintext HTTP request. This is called SSL/TLS termination.
- Inspection: The LB reads the full HTTP request — the method (
GET,POST), the URL path (/api/v1/users), headers (Cookie: VIP_ACCESS=true,User-Agent: iPhone), and even the request body if needed. - Routing Decision: Based on configurable rules (called ACLs — Access Control Lists — in HAProxy, or routing rules in AWS ALB), the LB selects a backend pool. For example: requests to
/api/*go to the API server pool; requests to/static/*go to the CDN origin pool. - New Upstream Connection: The LB opens a new TCP connection to the chosen backend server and forwards the (possibly re-encrypted) request. The backend never sees the original client connection directly.
Characteristics:
- "Smart" routing: Can make decisions based on URL paths, query parameters, cookies, HTTP headers, request body content, or even geographic IP data.
- TLS offloading: Backends receive unencrypted HTTP, removing the CPU cost of TLS from every application server. Certificates are managed in one place.
- Higher CPU cost: Decrypting TLS and parsing HTTP requires significantly more CPU than L4's header inspection. This is the fundamental trade-off.
- Connection pooling: Because the LB opens its own connections to backends, it can maintain a persistent connection pool — reusing TCP connections to backends rather than opening a new one per request, which reduces latency.
- Examples: Nginx (in proxy_pass mode), HAProxy (mode http), AWS Application Load Balancer (ALB), Envoy Proxy, Traefik.
Interviewers frequently ask: "What is TLS termination and why does it matter?" The answer has two parts. First, it centralizes certificate management — you update one certificate on the LB instead of on every backend server. Second, it offloads the CPU-intensive cryptographic work from application servers to the LB (or dedicated hardware), letting backends focus on business logic. A follow-up question is often: "What if you need end-to-end encryption all the way to the backend?" The answer is TLS re-encryption (or TLS passthrough at L4), where the LB either re-encrypts traffic before forwarding it, or at L4 simply passes the encrypted bytes without decrypting them at all.