Design Security Headers Service - System Design | WinJob

Problem Statement: Centralized HTTP Security Headers

Design a multi-tenant Security Headers Service that lets platform teams publish Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy from one audited control plane. Cloudflare Transform Rules, AWS Response Headers Policy, and NGINX more_set_headers solve slices of this; your interview answer must unify authoring, simulation, compilation, distribution, injection, and violation analytics.

Mechanisms (problem)

CSP
HSTS
control plane

Design reasoning (sec-001-problem)

Interviewers grade whether you treat headers as versioned policy, not static strings. For Problem Statement: Centralized HTTP Security Headers, connect choices to measurable outcomes: fewer XSS findings in pen tests, faster PCI evidence collection, and zero checkout regressions after CSP tightenings. Cite OWASP Secure Headers Project categories and explain report-only vs enforce lifecycles.

Quantify: 12K tenants, 50M host patterns, 4M RPS edge responses, ≤40ms p99 injection overhead, 60s max propagation, 200K CSP reports/min ingest. State fail-closed for admin mutations when the compiler is unhealthy, but fail-open to last-good bundle on the edge—never remove HSTS mid-flight.

Metrics snapshot

12K tenants
4M RPS
40ms p99 inject

Signal	Target
Edge RPS	4M/s peak
Bundle size	≤18KB gzip
Publish SLA	60s global
Violation ingest	200K/min

javaOne Dark Pro

1 public final class HeaderCtx1 {
2   private final String tenantId;
3   private final long bundleVersion;
4   private final String hostPattern;
5   public String cacheKey(String route) {
6     return tenantId + "|" + bundleVersion + "|" + hostPattern + "|" + route;
7   }
8   public boolean isStale(long live) { return bundleVersion < live; }
9 }

pythonOne Dark Pro

1 from dataclasses import dataclass
2  
3 @dataclass(frozen=True)
4 class HeaderDecision1:
5     tenant_id: str
6     bundle_version: int
7     host_pattern: str
8     enforce: bool
9     policy_id: str

typescriptOne Dark Pro

1 interface HeaderCtx1 {
2   tenantId: string;
3   bundleVersion: number;
4   hostPattern: string;
5   mode: "enforce" | "report-only";
6 }
7  
8 export function cacheKey(c: HeaderCtx1): string {
9   return [c.tenantId, c.bundleVersion, c.hostPattern, c.mode].join("|");
10 }

Operational checklist (problem)

1.1: Diff compiled bundle against golden template before canary.
1.2: Alert when CSP violation rate spikes 5× baseline per route.
1.3: Chaos-test compiler outage—edge must keep last-good bundle.
1.4: Track header byte size; block publishes that exceed 2KB total.
1.5: Sample report-only traffic before flipping Content-Security-Policy-Report-Only off.
1.6: Verify HSTS preload eligibility with HTTPS coverage dashboards.
1.7: Audit tenant override attempts on frame-ancestors weekly.
1.8: Measure simulate API vs production header diff median.
1.9: Run synthetic checks per PoP after bundle roll-forward.
1.10: Document rollback under 30s when checkout FP exceeds budget.

Close problem with numbers and a named trade-off—edge vs app injection, strict CSP vs third-party scripts—not “we’ll add headers in nginx.”

Why interviewers care

Security Headers Service interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem Statement: Centralized HTTP Security Headers that proves you understand real outages, not happy-path diagrams.

Key Highlights

•CSP
•HSTS
•control plane

1	public final class HeaderCtx1 {
2	private final String tenantId;
3	private final long bundleVersion;
4	private final String hostPattern;
5	public String cacheKey(String route) {
6	return tenantId + "\|" + bundleVersion + "\|" + hostPattern + "\|" + route;
7	}
8	public boolean isStale(long live) { return bundleVersion < live; }
9	}

1	from dataclasses import dataclass
2
3	@dataclass(frozen=True)
4	class HeaderDecision1:
5	tenant_id: str
6	bundle_version: int
7	host_pattern: str
8	enforce: bool
9	policy_id: str

1	interface HeaderCtx1 {
2	tenantId: string;
3	bundleVersion: number;
4	hostPattern: string;
5	mode: "enforce" \| "report-only";
6	}
7
8	export function cacheKey(c: HeaderCtx1): string {
9	return [c.tenantId, c.bundleVersion, c.hostPattern, c.mode].join("\|");
10	}