Session revocation across stateless servers

DesignMedium40 min

Your task

Design a 'manage your active sessions / sign out other devices' feature for a 120M-user product, the kind where a user sees a list ('iPhone, Lagos, 2h ago'; 'Chrome, Berlin, now') and can revoke any one, or 'sign out everywhere'. Sessions are backed by access tokens used across a fleet of stateless API servers. The challenge: each listed session must show accurate last-seen and device info, revoking one must take effect within seconds across all servers, and 'sign out everywhere except this one' must be atomic-ish. Discuss the session record model, how revocation reaches stateless servers fast, and how you keep the device list trustworthy.

It covers

  • Session fixation
  • Device trust
  • Concurrent eviction