Manage Authentication Tokens with a Fixed Time to Live

Question

This question asks the candidate to design a system for managing authentication tokens that have a fixed time to live (TTL). The candidate should demonstrate their understanding of token management and how to implement it effectively.

Codemia · Accepted Answer

To manage authentication tokens with a fixed time to live, we need to establish the following requirements:

1. **Token Generation**: Create tokens that are unique and securely generated.
2. **Expiration**: Tokens should have a fixed TTL after which they become invalid.
3. **Validation**: Implement a mechanism to validate tokens before granting access to protected resources.
4. **Revocation**: Provide a way to revoke tokens if necessary (e.g., user logout).

The high-level design of the token management system includes the following components:

- **Token Service**: Responsible for generating and validating tokens.
- **Database**: Stores user information and token metadata (e.g., creation time, expiration time).
- **API Gateway**: Handles incoming requests and checks for valid tokens before forwarding to backend services.
- **Cache**: Optionally used to store active tokens for quick validation.

The algorithm for managing tokens can be broken down into the following steps:

1. **Generate Token**: Use a secure random number generator to create a unique token string.
2. **Store Token**: Save the token in the database with its creation timestamp and TTL.
3. **Validate Token**: When a token is presented, check its existence in the database and compare the current time with the creation time plus TTL. If valid, grant access; otherwise, deny access.

Here is a simple implementation in Python:
```python
import time
import jwt

class TokenManager:
    def __init__(self, secret_key, ttl):
        self.secret_key = secret_key
        self.ttl = ttl
        self.tokens = {}

def generate_token(self, user_id):
        token = jwt.encode({'user_id': user_id, 'exp': time.time() + self.ttl}, self.secret_key, algorithm='HS256')
        self.tokens[token] = time.time()
        return token

def validate_token(self, token):
        if token in self.tokens:
            if time.time() < self.tokens[token] + self.ttl:
                return True
        return False
```

When designing a token management system, consider the following trade-offs:

- **Security vs. Performance**: Using JWTs allows for stateless authentication but requires careful handling of secret keys.
- **Database Load**: Storing tokens in a database can create bottlenecks, so using a cache can improve performance.
- **TTL Duration**: A shorter TTL increases security but may lead to more frequent logins, affecting user experience. Choose an appropriate balance based on application needs.

Manage Authentication Tokens with a Fixed Time to Live

IBM

What the Interviewer Expects

Key Topics to Cover

How to Approach This

Possible Follow-up Questions

Sharpen Your Skills on Codemia

Sample Answer

Requirements

High-Level Design

Submit Your Answer

IBM Software Engineer Interview Guide

Related Questions

Binary Search on graph

Count kth largest element in array

Find connected components in string

Merge Three Sorted strings

Binary Search on string