circuit-breaker.js·4 scenarios
Prevent cascading failures: CLOSED -> OPEN -> HALF-OPEN state transitions with fallback responses
The Circuit Breaker is a resilience pattern that prevents cascading failures in distributed systems by cutting off requests to a failing downstream service. Instead of letting every request fail slowly (consuming threads, connections, and time), the circuit breaker fails fast and redirects traffic to a fallback path.
The pattern is fundamental to building fault-tolerant microservices and is implemented in many frameworks and platforms:
An external client that sends requests through the circuit breaker proxy. The client is unaware of the circuit breaker state and simply receives either a normal response or a degraded fallback response.
The core component that wraps calls to the downstream service. It maintains a failure counter and a state machine. When the failure count exceeds the configured threshold (e.g., 3 failures), the circuit "opens" and all subsequent requests are short-circuited to the fallback without ever reaching the backend.
Returns a degraded or cached response when the circuit is open. A degraded response (stale data, default values, reduced functionality) is almost always better than an error or a timeout. The fallback keeps the overall system usable even when a dependency is down.
The downstream service protected by the circuit breaker. When this service is failing (overloaded, crashed, or its database is unreachable), the circuit breaker prevents it from receiving additional load, giving it time to recover.
The circuit breaker operates as a state machine with three states:
The circuit breaker tracks consecutive or windowed failures. When failures reach a configured threshold (e.g., 3 out of 5 requests, or 3 consecutive failures), the circuit transitions from CLOSED to OPEN. The threshold prevents a single transient error from tripping the circuit while still reacting quickly to sustained failures.
When the circuit opens, a timer starts. During this window, the backend receives zero traffic, giving it breathing room to recover. When the timer expires, the circuit enters HALF-OPEN and sends a single probe request. This probe-based recovery avoids flooding a barely-recovered service with full traffic.
Without a fallback, an open circuit simply returns errors faster. With a fallback, the system degrades gracefully: cached product listings instead of live data, default recommendations instead of personalized ones, or a "service temporarily limited" message instead of a 500 error. Degraded service is almost always preferable to no service.
The circuit breaker is most effective when combined with other resilience patterns:
Together, these patterns form a layered defense against the unpredictable failures inherent in distributed systems.