System Design

The seven-step dance behind 'Log in with Google'. Why the redirects exist, why the code is swapped for the token server-to-server, and where PKCE plugs the public-client hole.

When you stop asking users for a password, what do you verify instead? Three answers — OTP proves channel ownership, SSO and OAuth/OIDC delegate identity to a trusted issuer.

How a server remembers an authenticated user across HTTP's stateless requests — Basic resends credentials, session cookies pin server-side state, tokens carry signed claims. The tradeoffs that pick one.

PGP gives you two independent guarantees — secrecy via encryption with the recipient's public key, and authenticity via signing with your own private key. Most production uses want both, in that order.

Why passwords are hashed, never encrypted; why fast hashes like SHA-256 are wrong for this job; and how Argon2id / bcrypt / scrypt buy you decades against an attacker with the database.

Combine several signals into one comparable score by normalising each to [0,1] and taking a weighted sum. The maths is trivial; the trap is mixing raw, unbounded quantities and letting one signal dominate the rest.

How consistent hashing distributes keys across a changing set of nodes while keeping the number of re-mapped keys proportional to the change — and why naive modulo sharding falls apart the moment a node joins or leaves.

Why every non-GET endpoint that touches money or external state needs an idempotency key, and how to implement one without footguns.