Sender-constrained tokens: making a stolen token useless
Bind the token to a key that stays on the client, so a copy from logs or XSS is not enough.
More in the System design
- Case studies in System Design
- Who gets the last phone in a flash sale
- Which database for a food delivery app
- The cache expired and the database fell over
- A live final: scale before the toss
- An app like ChatGPT: the answer is written live
- A product Q&A box on sale day
- Tatkal at 10:00: one seat, sold in stretches
- A group chat: one register, many sockets
- Authentication in System Design
- JWT in System Design: Sessions, Revocation & Refresh
- The interview questions, answered
- Life of a session, step by step
- Anatomy of a JWT
- Forge lab: why verification must be strict
- JWT vs session
- The validation pipeline: where a bad request dies
- Revocation: the 12-minute problem
- Refresh tokens and rotation
- Logout in depth: one device, all devices, SSO
- What actually makes a JWT secure
- OAuth 2.0 and OIDC: how the token gets there
- Where the token lives on the client
- Microservices, keys, and trust boundaries
- Authentication vs authorization middleware
- Failure explorer: what breaks when X fails
- Capacity planner: sessions vs JWT vs hybrid
- Edge cases catalog
- Test it, measure it, migrate to it
- Anti-patterns to reject in a design review
- Design checklist and cheat sheet
More courses
- Jobs, linked to lessons — Browse jobs where every requirement links to the chapter that teaches it. See how ready you are, how long the gap takes to close, and which listings look stale.
- Match a job post to courses — Paste a job post. Each skill is matched to a track here and put in learning order, foundations first.
- React from open source with patterns — Patterns extracted from Material UI, Radix, React Aria, React Hook Form, Redux Toolkit, TanStack, and Next.js — not slides about hooks.
- Database in depth — How a query becomes work. Indexes, isolation, locks, and the plans that explain why a page is slow — not an ORM tour.
- Microservices — Microservice patterns one diagram at a time: how to split a monolith, how services talk, and how data stays consistent without distributed transactions.
- Kafka — A beginner-to-senior path through event logs, reliable delivery, production operations, and disaster recovery.
- Frontend system design — How a UI is sliced when it is a product, not a page: ownership of state, cache, routes, and what happens when the network lies.
- CSS in depth — See the box, then the page. Visual chapters from the box model through Flexbox surprises, Grid, selectors, and units, then backgrounds, shapes, and visual effects, each with a playground.
- Accessibility — HTML labs first, then a full pass of WAI-ARIA 1.3: naming, every state, widget and structure roles, live regions, ariaNotify, and relationships.
- Docker — What an image is, why layers cache, and how containers find each other on a network.
- Redis — Fifteen Redis patterns, one picture each: cache, session, lock, counter, rate limiter, queue, and when Redis is the wrong tool.