Design auth, session security, and top-N users
Web Application Design: Authentication, Security, and Top-N Active Users
Design a browser-based web application where users sign in and are greeted with "Hello, <username>". The application will use a single-page web client communicating with a backend service via JSON over HTTPS.
Tasks
-
Client–Server APIs
- Define REST endpoints for user sign-up, sign-in, sign-out, and fetching the greeting message.
- Specify request and response JSON shapes, appropriate HTTP status codes, and error handling mechanisms.
-
Authentication Approach
- Choose and justify an authentication strategy, considering stateful server-side sessions versus stateless tokens (e.g., JWT).
- Detail secure password storage, the potential for optional Multi-Factor Authentication (MFA), TLS requirements, Cross-Site Request Forgery (CSRF) protection, and Cross-Site Scripting (XSS) mitigations.
-
Post Sign-In Impersonation Risks
- Explain strategies to prevent impersonation attempts, such as reusing or guessing a user ID.
- Cover the design of session identifiers or tokens, ensuring sufficient entropy, rotation/expiration policies, secure storage (e.g., cookie flags like
HttpOnly,Secure,SameSite), token binding, refresh token flows, and defenses against session fixation, replay attacks, and token theft.
-
Top N Active Users Service
- Design an endpoint and an underlying service that efficiently returns the top N most active users over a recent time window.
- Clearly define what constitutes an "active" user and the signals that will be counted (e.g., requests, specific user actions).
- Propose a data model and an efficient computation approach (e.g., sliding-window counters, stream processing, precomputed aggregations).
- Address scalability considerations, consistency tradeoffs, rate limiting strategies, and perform back-of-the-envelope capacity planning for this service.
AI interview prep
Core dilemma
Balancing robust, multi-layered security for user authentication and session management with the performance and scalability demands of real-time analytics for active users.
3 tradeoffs and 3 stress tests locked
Interview prep
Unlock the interviewer X-Ray rubric, tradeoff matrix, stress tests, clarifying questions, and key concepts.
Design auth, session security, and top-N users
Web Application Design: Authentication, Security, and Top-N Active Users
Design a browser-based web application where users sign in and are greeted with "Hello, <username>". The application will use a single-page web client communicating with a backend service via JSON over HTTPS.
Tasks
-
Client–Server APIs
- Define REST endpoints for user sign-up, sign-in, sign-out, and fetching the greeting message.
- Specify request and response JSON shapes, appropriate HTTP status codes, and error handling mechanisms.
-
Authentication Approach
- Choose and justify an authentication strategy, considering stateful server-side sessions versus stateless tokens (e.g., JWT).
- Detail secure password storage, the potential for optional Multi-Factor Authentication (MFA), TLS requirements, Cross-Site Request Forgery (CSRF) protection, and Cross-Site Scripting (XSS) mitigations.
-
Post Sign-In Impersonation Risks
- Explain strategies to prevent impersonation attempts, such as reusing or guessing a user ID.
- Cover the design of session identifiers or tokens, ensuring sufficient entropy, rotation/expiration policies, secure storage (e.g., cookie flags like
HttpOnly,Secure,SameSite), token binding, refresh token flows, and defenses against session fixation, replay attacks, and token theft.
-
Top N Active Users Service
- Design an endpoint and an underlying service that efficiently returns the top N most active users over a recent time window.
- Clearly define what constitutes an "active" user and the signals that will be counted (e.g., requests, specific user actions).
- Propose a data model and an efficient computation approach (e.g., sliding-window counters, stream processing, precomputed aggregations).
- Address scalability considerations, consistency tradeoffs, rate limiting strategies, and perform back-of-the-envelope capacity planning for this service.