Integration gateway

The value of a gateway is not in passing messages along. It is in having a considered answer for what happens when a backend is slow, down, or replying with nonsense — and in making that answer the same for every caller, so twelve client teams do not each invent their own retry loop.

Here that means a canonical request and result shape that callers speak regardless of which backend serves them. That broadband provisioning is a twenty-year-old SOAP service and mobile is a modern REST API is the gateway's problem, not theirs.

A 503 means try later, and a retry with backoff is exactly right. A 400 means the request is wrong, and four more attempts produce four more 400s while holding a connection open and delaying the caller's error. Retrying everything is the default mistake, and it converts a small backend wobble into a self-inflicted load spike at the worst possible moment.

A SOAP fault gets the same treatment as a 4xx. It is a considered answer that will be identical next time, so it maps to a failed result rather than three more attempts. The test asserts the backend was called exactly once.

The test for 429 handling failed on its first run: eight requests reached the backend where four were expected. Apache HttpClient retries 429 and 503 by default, underneath Camel's error handler, so the two layers multiplied — and because the inner layer knows nothing about the outer backoff, the attempts also came twice as fast as intended.

This is the kind of defect that never surfaces in a functional test, because the request still succeeds. It surfaces in production, as a backend that is already struggling receiving double the retries anyone intended. Retry policy belongs in exactly one place; here that is the route, because only the route knows which failures are worth retrying and who is waiting for the answer.

The SOAP envelope is assembled as text, which makes the bytes on the wire obvious and puts the burden of escaping squarely on this code. Without it, a subscriber id containing a closing tag lets a caller write arbitrary elements into the envelope — the XML equivalent of SQL injection. The test feeds exactly that and asserts the injected element does not appear.

In the other direction, the response parser disables DTDs entirely. A SOAP response is XML from another system, and a document declaring an external entity can make the parser read local files or open outbound connections — unauthenticated, and invisible in a response that otherwise looks normal. The test feeds the classic payload and asserts it is refused.