Session Store
Every request pays this lookup — it has to be nearly free.
Validate a session on every request, in single-digit milliseconds, through a login storm and a store blip.
Every authenticated request pays this lookup — it has to be near-free. A hot in-memory cache in front of the session store is the only thing standing between a normal morning and every logged-in user getting bounced at once.
Components in play
- Edge LB — Spreads every incoming request across the session API fleet.
- Session API — Validates the session token on every request.
- Session cache — Holds live sessions in memory so validation skips the store.
- Session store — Durable source of truth for session state.
Graded on these SLOs
- ≥ 99.00%Sessions validate
- ≤ 25 msValidation p99
- ≥ 6.0k rpsSustain the login storm
- ≤ 90%Fleet headroom
- ≤ 6Lean footprint
The brief
Design the session-validation service that sits on every authenticated request across the product. It has to answer 'is this session valid' in single-digit milliseconds, thousands of times a second, and it can never be the reason a logged-in user gets bounced — even during a morning login storm or a session-store blip.
Functional
- Validate a session token on every request
- Create a session on login
- Expire sessions on logout or timeout
Non-functional
- Sub-10ms validation budget — this runs on every request
- High availability — a down session store logs everyone out
- Survives a synchronized login storm
Warm-up: design decisions
Optional theory to prime the calls a senior engineer would make before you build.
Solving is a Pro feature
Unlock the on-canvas AI design coach, per-run design reviews, the chaos simulator and all 12 problems for $15/month.
- AI design coach on your canvas — pins failure points & over-engineering
- Honest AI design review on every run
- All 12 problems + unlimited chaos simulator
- Points, levels & leaderboard