Canva Shares S3-Based Architecture for Session Revocation Across Hundreds of Millions of Sessions

InfoQ news item (2026-08-10), by Leela Kumili — the write-up of Canva’s engineering post that brought the source into this spoke. It reports the same architecture and adds the practitioner reaction around it.

What it adds over the primary

• The framing that travels. Software engineer Adam Urban reads S3 here as “more than an object store”, using “immutable objects and conditional writes as coordination primitives”. That is the generalization the primary post leaves implicit, and the reason this spoke pages object-storage-as-coordination as a mechanism rather than as a Canva detail.
• The load argument restated as a shape. InfoQ names the old failure directly: hundreds of gateway instances each requesting over a million revocations from MySQL at deploy time, so database load tracked instance count. It now tracks write throughput and traffic instead.

Where it is looser than the primary

The headline calls the result “near-real-time” revocation; the primary specifies propagation within minutes via conditional GET (canva-session-revocations-at-scale). Not a contradiction, but the secondary framing hides the size of the window a revoked session survives in — take the number from the primary.

T3 — secondary tech-news coverage of a first-party post; every figure originates with Canva. Same tier and same posture as ebpf-kernel-observability-infoq and netflix-service-topology.

Related

canva-session-revocations-at-scale · session-revocation · object-storage-as-coordination · canva · infoq · platform-ops