← bridge.xyz Interview Insights

bridge.xyz·Software Engineer·Onsite - System Design / Architecture·Intermediate

IntermediatePrefer not to say
May 2026Remote

Summary

System design round at bridge.xyz for a software engineer role, focused entirely on building an auth service from scratch with no third-party OAuth allowed. Pretty meaty for a single question but it covered a lot of ground fast.

Questions Asked (1)

Q1

Design a simple authentication service that handles user sign-up and login, built entirely in-house without relying on any external auth providers.

System DesignAPI & IntegrationsTechnical Trade-offs
Author's notes

Covered the API layer first since that felt most concrete.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by clarifying requirements (scale, security, compliance) and then outline the core components: user registration, login, session management, and password storage. Focus on security best practices like hashing (bcrypt/argon2), token-based sessions (JWT), and rate limiting, while discussing trade-offs between simplicity and scalability.

Pro tip: Emphasize that you would never store plaintext passwords and would use a proven library like bcrypt rather than rolling your own crypto. Also, mention that you'd design for extensibility (e.g., adding MFA later) without over-engineering the initial version.

1. Clarify Requirements and Constraints

Ask about expected scale (users, requests per second), security/compliance needs (e.g., GDPR, PCI), and whether features like MFA or password reset are in scope. This shows you don't jump to solutions prematurely.

2. Design Data Model and Storage

Define a users table with fields like id, email, password_hash, created_at, and optionally salt. Discuss using a relational database (e.g., PostgreSQL) for ACID compliance and indexing on email for fast lookups.

3. Define API Endpoints and Flows

Outline endpoints: POST /signup (validate input, hash password, store user), POST /login (verify credentials, issue token), and POST /logout (invalidate token). Include error handling and status codes.

4. Implement Security Measures

Cover password hashing with bcrypt/argon2, token generation (JWT with expiration), secure transmission (HTTPS), rate limiting to prevent brute force, and input validation to prevent injection.

5. Discuss Scalability and Trade-offs

Talk about horizontal scaling (stateless JWT vs. session store), caching, and potential bottlenecks. Mention trade-offs like JWT revocation complexity vs. session store overhead.

Key Points to Mention

  • Password hashing with bcrypt or argon2, including salting and work factors
  • Token-based authentication (JWT) with expiration and refresh tokens
  • Rate limiting and account lockout to mitigate brute force attacks
  • Input validation and sanitization to prevent SQL injection and XSS
  • Secure session management (HTTP-only cookies, CSRF protection if using cookies)
  • Trade-offs between stateless JWT and server-side sessions for scalability and revocation

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.