HLD-205·Caching & Consistency
Medium · 1,000 ptsGlobal Session & Auth Token Verification Store
Design a high-availability session validation and revocation service sitting on the critical path of every authenticated API call, with immediate logout/revocation enforcement.
Max p99
≤ 32 ms
Availability
≥ 99.5%
Budget
≤ $4,200
Functional Requirements
- FR-1GET /auth/verify?token={session_id} — Validates active session claims on every upstream request.
- FR-2POST /auth/revoke — Revokes or rotates session_id upon logout or password reset.
- FR-3PATCH & DELETE /auth/verify/{session_id} — Updates, cancels, or deletes session_id records and immediately invalidates or updates cached state (read-after-write).
- FR-4Revoked sessions must not remain valid in stale caches (read-after-write revocation consistency).
Workload Profile
Baseline Traffic45,000 Verify Read RPS / 3,500 Login/Revoke Write RPS
Morning Surge125,000 Read RPS / 9,000 Write RPS
Active Working Set20 GB active session & revocation records
Availability TargetTier-0 auth dependency requiring >= 99.5% uptime
Consistency Model
Read-after-write consistency required: session revocations and rotations must immediately invalidate or update cache tiers.
Solutions Locked
Sign in and either achieve AC or complete 3 official submissions on this question to inspect community diagrams and writeups.
Loading solutions...
Submission History (0)Select to replay
No submissions yet
Click Submit in the top bar to evaluate against all 7 judge cases and save each run here.
Design Write-up
0 boxes · 0 edges
0 words