Stolen token
Lock 02Fix the board. Turn every goal green.
- Traffic
- 2,000 req/s · reads only
- Limit
- Postgres answers about 1,500 reads/s
- Bill
- Load balancer (L7)4 USD/mo
- Postgres4 USD/mo
- API server × 312 USD/mo
- Local cache × 36 USD/mo
26 of 60 USD/mo
Goals
Not tested yet
Each API instance checks a session token once, then trusts it for 24 hours. A revoked session keeps working on the other instances. A revoked token must stop within 5 minutes. Keep p99 under 80 ms. You have 5 edits.
0:05. A user reset the password after a phishing email. The stolen token still opens the account. Graph: freshness keeps rising.
Parts you can add: Managed pub/sub, Managed queue, Local cache, Redis cache. At most 12 parts. Budget: 60 USD/mo.
Tap a part to add it, or drag it onto a trace.Click a part to add it, or drag it onto a trace.