A 118-character URL. 15 characters back.
Designing a link shortener on Azure — and the one digit that decides whether you ever see your click stats.
What you'll learn
- Why a link shortener is really two systems: one write, a thousand reads
- How the short code is made, and what Cosmos DB does when two people roll the same one
- Why the redirect must be 302 and not 301, and why Front Door answers most clicks
Share this passage
Drawing…
Understand it one step at a time
The short runs these in order in about 65 seconds. Here they are written out — pick any step to jump the short straight to it.
One giant URL, one tiny link
Same destination, roughly 8 times fewer characters to type or paste. On the surface, that's the entire product in one sentence.
Frequently asked questions
- Why should a URL shortener's redirect be a 302, not a 301?
- A 301 is a permanent redirect that browsers and CDNs cache aggressively, so click analytics stop reaching your service after the first visit. A 302 is treated as temporary, so every click is still routed through and countable.
- What does Cosmos DB do if two requests generate the same short code?
- The design has to handle the collision explicitly — the write path checks for an existing code and retries with a new one rather than assuming uniqueness, since two concurrent requests can otherwise generate the same code independently.
Free app · no app store
These are built for a phone
Every short is drawn at full portrait height, the shape a phone already is. Installed, it opens full-bleed with no address bar across the top — and the whole library reads offline.
Read deeper on Azure
Twenty seconds gets the shape of an idea across. These go into how it behaves in production.
-
AI Bot Attacks on a Mobile App Login, and How Azure Stops Them
A script tries 8,000 passwords a minute against your login API at 3am. Rate limiting, smart lockout and Defender for Cloud make speed the losing move.
-
Azure Key Vault Explained: The One Secret Tutorials Never Remove
Moving every secret into Key Vault leaves exactly one behind: the credential that opens the vault. A managed identity is what removes it.
-
How to Secure a Mobile API on Azure in Five Steps, in the Right Order
HTTPS only, authentication, authorization, secrets and monitoring: five steps to secure a mobile API on Azure, and why the order carries most of the value.
More shorts
-
Azure
Money debited. Order failed.
10 steps · 56s
-
Azure
One tap. Two orders.
10 steps · 57s
-
Azure
1.6 million downloads. One photo.
10 steps · 58s
Get new posts by email
New technical articles, Azure AI and GitHub Copilot updates, and upcoming events. No spam, unsubscribe anytime.
MSDEVBUILD
/ blog Multi-Stack Dev Build · by Suthahar Azure