Layer 3 · Go deeper · 10 min
Go deeper
Size it, build it, then make the calls an interviewer will push you on.
Back of the envelope
Size it up
Tap through each step of the arithmetic.
How long to guess one live session ID with 64 bits?
How big does a jti denylist get?
What do ES256 checks cost at 20,000 requests a second?
Build-up · 5 steps
A session from login to logout
The browser only ever holds a random ID; everything the server knows lives in Redis under that ID. Follow one login through to logout.
Step 1 of 5
Prove it once
The browser posts email and password, and the server checks the slow, salted Argon2id hash. That proves who you are once; everything after is about remembering it.
4 interview moments
You’re the candidate
The interviewer pushes on the hard parts. Pick an approach and see how it holds up.
Deep dive 1 of 4
Interviewer
“You’re building one first-party web app with a single backend. How should it remember a logged-in user?”
Your move. Pick an approach:
Deep dive 2 of 4
Interviewer
“Twelve services must verify your access tokens. How do you sign them?”
Your move. Pick an approach:
Deep dive 3 of 4
Interviewer
“A user reports a stolen phone and taps “log out everywhere”. Their apps hold 15-minute JWTs. What do you do?”
Your move. Pick an approach:
Deep dive 4 of 4
Interviewer
“Your single-page app needs an access token for API calls. Where should it live?”
Your move. Pick an approach:
Build-up · 5 steps
Catch a stolen refresh token
Access tokens last 15 minutes, and every refresh swaps the refresh token for a new one. Follow one login family as an attacker steals a token.
Step 1 of 5
Log in: family F7
Login returns a 15-minute access token, AT1, and a refresh token, RT1. The auth server records RT1 as the first token of family F7.