Mock Interviewer
Ask Coach
Tap a question to start, or type your own below.
Auth System Design
Visual Problem Diagram
Scenario
A product needs email and password authentication for web and mobile users. People must be able to sign up, log in, stay signed in, reset a forgotten password, optionally use MFA, and sign out from a stolen device. At the same time, bots are trying credential stuffing with leaked passwords, so the design must protect accounts and the login infrastructure.
Design an authentication system with registration, login, logout, password reset, optional MFA, session validation, and revoke. Security failures here are not abstract. They become account takeover, leaked credentials, stolen sessions, and users locked out during attacks.
Constraints
Register, login, logout, validate sessions, refresh tokens if used, reset passwords, optional MFA, revoke sessions, audit security events.
Login p95 around a few hundred milliseconds for real users, strong password storage, high availability for session validation, clear failure behavior, and resistance to brute force and credential stuffing.
Millions of users, many active sessions, login spikes during attacks, and far more session checks than password verifications.
Stages ahead
Log in to start practicing
Preview the problem below. Sign in to start your timed session, save progress, and use the AI coach.