Design Authentication and Sessions
MediumSystem design · Identity
Design an authentication service. Users can sign up, log in with a password and optional MFA, stay signed in across devices, log out (one device or all), recover accounts, and access protected APIs securely.
In scope: credential storage, token and session design, refresh and revocation, abuse protection, MFA and recovery. Out of scope: authorization or permissions (see the RBAC problem) and acting as an OAuth identity provider for third parties.
Requirements
- Store passwords with a slow, salted, memory-hard hash and upgrade parameters over time
- Issue short-lived access tokens and rotating, revocable refresh tokens with reuse detection
- Revocation effective within about 60 seconds, and logout-all-devices
- Resist credential stuffing, enumeration and phishing, with risk-based MFA and safe recovery flows