Session revocation

Cutting off a session that is already authenticated — a logout everywhere, a password change, a compromised account, an employee leaving. It is a trivial operation when sessions live in a server-side store: delete the row. It becomes a distributed-systems problem the moment sessions are stateless.

Why stateless auth creates the problem

A stateless session ships everything the server needs inside the credential itself — a signed or encrypted cookie or JWT carrying the user ID, roles, and permissions. The gain is that no request has to touch a session store. The cost is that there is nothing to delete: the credential stays valid until it expires, in whoever’s browser holds it. Revocation therefore has to be a deny-list that every request-serving process consults, which reintroduces the shared state that stateless auth existed to avoid (canva-session-revocations-at-scale).

The two levers

• Bound the list with the token lifetime. If every token refreshes within N hours, a revocation older than N hours can be dropped, because no credential issued before it still exists. Canva’s N is 12 hours, which turns an unbounded deny-list into a sliding window (canva-session-revocations-at-scale). Short token lifetimes shrink the list — and raise refresh traffic against whatever issues tokens, which is the trade Canva made in the other direction.
• Hold the window in memory, not behind a query. Checking a database per request puts the auth path’s availability on the database. Every gateway keeping the whole window locally removes that dependency, and a 16-byte packed record makes it affordable: a million revocations is about 16 MB (canva-session-revocations-at-scale).

What that leaves

Two problems, both operational rather than cryptographic:

• Seeding. Every process needs the window before it can serve traffic, so a fleet-wide deploy is a fleet-wide read. Done against a database, the load scales with instance count rather than with how many revocations exist. This is the failure Canva’s S3 chunks were built to remove (object-storage-as-coordination).
• Propagation delay. A locally-held deny-list is stale between refreshes, so a revoked session keeps working for the length of that gap — minutes, in Canva’s case. Instant revocation and a no-shared-dependency auth path are the two ends of the same trade, and every stateless design picks a point on it.

Where it sits here

The zero-trust posture in defensive-security-wiki assumes continuous verification of an active session; this page is the mechanics of the part where verification says no and has to reach a fleet. Structurally it is the same move the spoke keeps meeting: take a shared component off the hot path, accept a stale local view, correct after the fact (modal-1m-sandboxes, zalando-cslb-1m-rps) — here applied to authorization state rather than to placement or routing.

Related

canva-session-revocations-at-scale · object-storage-as-coordination · canva-session-revocation-infoq · modal-1m-sandboxes · zalando-cslb-1m-rps · production-readiness · platform-ops