Design a Scalable Product Authentication Platform
Company: MathWorks
Role: Software Engineer
Category: System Design
Difficulty: medium
Interview Round: Onsite
Design the authentication infrastructure for a cloud product. Users log in with email and password; the design should be able to add external identity providers later. Cover the login flow, APIs, storage schema, credential protection, session lifecycle, database choice, backup and recovery, and a path to ten times the original traffic.
### Constraints & Assumptions
- The system serves browser and API clients.
- Authentication establishes identity; product-specific authorization is a separate concern but must consume the identity safely.
- Passwords must never be stored reversibly.
- Clients may retry requests, sessions may be revoked, and an attacker may attempt credential stuffing.
- Availability matters, but weakening credential verification during an outage is not acceptable.
### Clarifying Questions to Ask
- What login methods, regulatory constraints, and session durations are required?
- Must revocation take effect immediately across all services?
- Is multi-factor authentication required for all users or only risky actions?
- What recovery-point and recovery-time objectives apply to identity data?
### What a Strong Answer Covers
- Draws clear trust boundaries among clients, edge services, authentication logic, data stores, and downstream services.
- Defines login, refresh, logout, password reset, and external-provider APIs without leaking account existence.
- Uses a relational identity model with unique normalized identifiers and safe credential hashing.
- Explains session-token choices, key rotation, revocation, replay resistance, and CSRF defenses.
- Includes rate limits, audit trails, abuse detection, backups, restore drills, and staged scaling.
- Separates authentication from authorization and avoids a single unbounded global bottleneck.
### Follow-up Questions
1. How would you revoke sessions after a password reset without querying a central database on every request?
2. What changes are needed for organization-managed single sign-on?
3. How would you migrate password-hash parameters without forcing every user to reset a password?
Quick Answer: Design authentication infrastructure for browser and API clients using email and password today with room for external identity providers later. Cover secure credentials, session lifecycle, abuse resistance, recovery, database choices, trust boundaries, and a path to tenfold traffic.