bridge.xyz·Software Engineer·Onsite - System Design / Architecture
- Design a basic email and password authentication service supporting user sign-up and login, without using any third-party identity providers.
- How should passwords be stored securely, and why can't you just use a standard hash like SHA-256?
- How do you manage login state after a user authenticates, and what are the tradeoffs between opaque session tokens and JWTs?
- What is user enumeration and how do you prevent it, including the timing side channel?
- How would you handle 'log out from all devices' and force re-login after a password change?
- Where would email verification and password reset flows attach to this design, and what new tables or tokens would they require?
“Big open-ended question to start.”