System design interview question
Design a Distributed Session Management Service for a Global Platform (like Auth0 at scale)
Design a highly available, distributed session management service that handles authentication and authorization for a global platform serving 500M monthly active users across 6 continents. The system must support 50K concurrent session creations per second with sub-100ms latency SLAs, enforce fine-grained access control policies, support session revocation within 5 seconds globally, and maintain strict consistency for sensitive operations (privilege escalations, permission changes). Sessions expire within configurable windows (15 minutes to 30 days), and the system must detect and mitigate session hijacking attempts in real-time while supporting OAuth 2.0 and SAML integrations. Consider edge cases around clock skew, network partitions, and compliance requirements (GDPR, regional data residency).
Practice this question step by step with an AI interviewer that reviews your requirements, your architecture and your trade-offs, and scores the design.