System Design: Building an Authentication System
How Apps With 100M Users Recognize You Without Your Password!
After login, a phone calls the servers hundreds of times. A session ID checked in Redis on every request adds a million extra lookups per second at peak, and every service stalls when Redis slows down. A signed JWT access token removes that lookup. The login server signs it with a private key, and each service verifies the signature and expiry on its own with the public key.
The access token expires in 15 minutes to limit the damage if it gets stolen. A long-lived refresh token fetches a new one, and the server rotates the refresh token on every use. If an old refresh token shows up again, the server treats it as theft and ends the session.
Session IDs in Redis or JWTs, which would you pick for your app? Drop your answer in the comments.
#SystemDesign #JWT #Authentication #RefreshToken #AccessToken #BackendEngineering #Redis #APIGateway #Microservices #WebSecurity #SystemDesignInterview #DevOps #KodeKloud #Shorts
After login, a phone calls the servers hundreds of times. A session ID checked in Redis on every request adds a million extra lookups per second at peak, and every service stalls when Redis slows down. A signed JWT access token removes that lookup. The login server signs it with a private key, and each service verifies the signature and expiry on its own with the public key.
The access token expires in 15 minutes to limit the damage if it gets stolen. A long-lived refresh token fetches a new one, and the server rotates the refresh token on every use. If an old refresh token shows up again, the server treats it as theft and ends the session.
Session IDs in Redis or JWTs, which would you pick for your app? Drop your answer in the comments.
#SystemDesign #JWT #Authentication #RefreshToken #AccessToken #BackendEngineering #Redis #APIGateway #Microservices #WebSecurity #SystemDesignInterview #DevOps #KodeKloud #Shorts
KodeKloud
...