System Design: Security

Master modern authentication, authorization, OAuth 2.0 / OIDC, SSO, distributed rate limiting algorithms, API security, envelope encryption, DDoS mitigation, and GDPR compliance.

1. Authentication (AuthN) vs Authorization (AuthZ)

Security in distributed architectures begins with two distinct pillars: verifying who a user is (Authentication) and determining what actions they are permitted to execute (Authorization).

Authentication vs Authorization Pipeline & Access Decision Flow

System Design

Tracing credentials verification, 401 Unauthorized handling, Policy Decision Points (PDP), and 403 Forbidden checks

100%

Loading system design canvas…

[
  {
    "id": "user-node",
    "type": "rectangle",
    "x": 30,
    "y": 110,
    "width": 140,
    "height": 70,
    "strokeColor": "#3b82f6",
    "backgroundColor": "#eff6ff",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15000,
    "version": 1,
    "versionNonce": 15001,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "user-node-text"
      }
    ]
  },
  {
    "id": "user-node-text",
    "type": "text",
    "x": 40,
    "y": 131,
    "width": 120,
    "height": 28,
    "strokeColor": "#1e40af",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15002,
    "version": 1,
    "versionNonce": 15003,
    "isDeleted": false,
    "text": "Client / User\n(Credentials / Token)",
    "fontSize": 11,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "Client / User\n(Credentials / Token)",
    "containerId": "user-node"
  },
  {
    "id": "a-authn",
    "type": "arrow",
    "x": 170,
    "y": 145,
    "width": 60,
    "height": 0,
    "strokeColor": "#3b82f6",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "points": [
      [
        0,
        0
      ],
      [
        60,
        0
      ]
    ],
    "endArrowhead": "arrow",
    "seed": 15004,
    "version": 1,
    "versionNonce": 15005,
    "isDeleted": false
  },
  {
    "id": "authn-node",
    "type": "rectangle",
    "x": 230,
    "y": 95,
    "width": 180,
    "height": 100,
    "strokeColor": "#8b5cf6",
    "backgroundColor": "#f3e8ff",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15006,
    "version": 1,
    "versionNonce": 15007,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "authn-node-text"
      }
    ]
  },
  {
    "id": "authn-node-text",
    "type": "text",
    "x": 240,
    "y": 110.625,
    "width": 160,
    "height": 68.75,
    "strokeColor": "#5b21b6",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15008,
    "version": 1,
    "versionNonce": 15009,
    "isDeleted": false,
    "text": "1. Authentication (AuthN)\n\n\"Who are you?\"\nVerify Password / MFA / JWT\nResult: 401 if invalid",
    "fontSize": 11,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "1. Authentication (AuthN)\n\n\"Who are you?\"\nVerify Password / MFA / JWT\nResult: 401 if invalid",
    "containerId": "authn-node"
  },
  {
    "id": "authn-to-authz",
    "type": "arrow",
    "x": 410,
    "y": 145,
    "width": 60,
    "height": 0,
    "strokeColor": "#8b5cf6",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "points": [
      [
        0,
        0
      ],
      [
        60,
        0
      ]
    ],
    "endArrowhead": "arrow",
    "seed": 15010,
    "version": 1,
    "versionNonce": 15011,
    "isDeleted": false
  },
  {
    "id": "authz-node",
    "type": "rectangle",
    "x": 470,
    "y": 95,
    "width": 190,
    "height": 100,
    "strokeColor": "#059669",
    "backgroundColor": "#ecfdf5",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15012,
    "version": 1,
    "versionNonce": 15013,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "authz-node-text"
      }
    ]
  },
  {
    "id": "authz-node-text",
    "type": "text",
    "x": 480,
    "y": 110.625,
    "width": 170,
    "height": 68.75,
    "strokeColor": "#065f46",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15014,
    "version": 1,
    "versionNonce": 15015,
    "isDeleted": false,
    "text": "2. Authorization (AuthZ)\n\n\"What can you do?\"\nRBAC / ABAC / Policy Check\nResult: 403 if forbidden",
    "fontSize": 11,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "2. Authorization (AuthZ)\n\n\"What can you do?\"\nRBAC / ABAC / Policy Check\nResult: 403 if forbidden",
    "containerId": "authz-node"
  },
  {
    "id": "authz-to-res",
    "type": "arrow",
    "x": 660,
    "y": 145,
    "width": 60,
    "height": 0,
    "strokeColor": "#059669",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "points": [
      [
        0,
        0
      ],
      [
        60,
        0
      ]
    ],
    "endArrowhead": "arrow",
    "seed": 15016,
    "version": 1,
    "versionNonce": 15017,
    "isDeleted": false
  },
  {
    "id": "res-node",
    "type": "rectangle",
    "x": 720,
    "y": 105,
    "width": 140,
    "height": 80,
    "strokeColor": "#0284c7",
    "backgroundColor": "#e0f2fe",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15018,
    "version": 1,
    "versionNonce": 15019,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "res-node-text"
      }
    ]
  },
  {
    "id": "res-node-text",
    "type": "text",
    "x": 730,
    "y": 124.375,
    "width": 120,
    "height": 41.25,
    "strokeColor": "#0369a1",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15020,
    "version": 1,
    "versionNonce": 15021,
    "isDeleted": false,
    "text": "Protected API\n& Database\n(HTTP 200 OK)",
    "fontSize": 11,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "Protected API\n& Database\n(HTTP 200 OK)",
    "containerId": "res-node"
  }
]

`Authentication (AuthN), 401 Unauthorized`

Confirms user identity via Passwords, Time-Based One-Time Passwords (TOTP MFA), Biometrics (WebAuthn/FIDO2), or cryptographic signatures. If identity verification fails, the server responds with HTTP 401 Unauthorized.

Password Hashing: Argon2id, bcrypt, PBKDF2 (salted, slow hashes)
Multi-Factor Authentication (MFA): TOTP (RFC 6238), SMS, Hardware keys (YubiKey)

`Authorization (AuthZ), 403 Forbidden`

Evaluates if an authenticated identity has permission to access a target resource. If the user is identified but lacks permissions, the server responds with HTTP 403 Forbidden.

RBAC (Role-Based Access Control): Roles assigned permissions (Admin, Editor, Viewer)
ABAC (Attribute-Based Access Control): Dynamic policies using user, resource, & environment attributes

2. Session-Based Auth vs Token-Based Auth (JWT)

Architects choose between stateful session IDs stored in centralized caches (like Redis) and stateless signed JSON Web Tokens (JWTs) validated locally on each microservice node.

Session-Based (Stateful) vs JWT Token-Based (Stateless) Architecture

System Design

Comparing Redis session lookups against distributed asymmetric signature validation (RS256)

100%

Loading system design canvas…

[
  {
    "id": "sess-box",
    "type": "rectangle",
    "x": 30,
    "y": 40,
    "width": 400,
    "height": 270,
    "strokeColor": "#f59e0b",
    "backgroundColor": "#fffbeb",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15022,
    "version": 1,
    "versionNonce": 15023,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "sess-box-text"
      }
    ]
  },
  {
    "id": "sess-box-text",
    "type": "text",
    "x": 40,
    "y": 161,
    "width": 380,
    "height": 28,
    "strokeColor": "#b45309",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15024,
    "version": 1,
    "versionNonce": 15025,
    "isDeleted": false,
    "text": "Session-Based Auth (Stateful)",
    "fontSize": 13,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "Session-Based Auth (Stateful)",
    "containerId": "sess-box"
  },
  {
    "id": "sess-client",
    "type": "rectangle",
    "x": 50,
    "y": 90,
    "width": 120,
    "height": 50,
    "strokeColor": "#d97706",
    "backgroundColor": "#fef3c7",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15026,
    "version": 1,
    "versionNonce": 15027,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "sess-client-text"
      }
    ]
  },
  {
    "id": "sess-client-text",
    "type": "text",
    "x": 60,
    "y": 101,
    "width": 100,
    "height": 28,
    "strokeColor": "#92400e",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15028,
    "version": 1,
    "versionNonce": 15029,
    "isDeleted": false,
    "text": "Client\n(Cookie: sid=abc)",
    "fontSize": 10,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "Client\n(Cookie: sid=abc)",
    "containerId": "sess-client"
  },
  {
    "id": "s-arr1",
    "type": "arrow",
    "x": 170,
    "y": 115,
    "width": 60,
    "height": 0,
    "strokeColor": "#d97706",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "points": [
      [
        0,
        0
      ],
      [
        60,
        0
      ]
    ],
    "endArrowhead": "arrow",
    "seed": 15030,
    "version": 1,
    "versionNonce": 15031,
    "isDeleted": false
  },
  {
    "id": "sess-server",
    "type": "rectangle",
    "x": 230,
    "y": 90,
    "width": 180,
    "height": 50,
    "strokeColor": "#d97706",
    "backgroundColor": "#fef3c7",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15032,
    "version": 1,
    "versionNonce": 15033,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "sess-server-text"
      }
    ]
  },
  {
    "id": "sess-server-text",
    "type": "text",
    "x": 240,
    "y": 101,
    "width": 160,
    "height": 28,
    "strokeColor": "#92400e",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15034,
    "version": 1,
    "versionNonce": 15035,
    "isDeleted": false,
    "text": "API Server\nLook up sid in Memory/DB",
    "fontSize": 10,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "API Server\nLook up sid in Memory/DB",
    "containerId": "sess-server"
  },
  {
    "id": "s-arr2",
    "type": "arrow",
    "x": 320,
    "y": 140,
    "width": 0,
    "height": 50,
    "strokeColor": "#d97706",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "points": [
      [
        0,
        0
      ],
      [
        0,
        50
      ]
    ],
    "endArrowhead": "arrow",
    "seed": 15036,
    "version": 1,
    "versionNonce": 15037,
    "isDeleted": false
  },
  {
    "id": "sess-redis",
    "type": "rectangle",
    "x": 230,
    "y": 190,
    "width": 180,
    "height": 50,
    "strokeColor": "#dc2626",
    "backgroundColor": "#fee2e2",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15038,
    "version": 1,
    "versionNonce": 15039,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "sess-redis-text"
      }
    ]
  },
  {
    "id": "sess-redis-text",
    "type": "text",
    "x": 240,
    "y": 201,
    "width": 160,
    "height": 28,
    "strokeColor": "#991b1b",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15040,
    "version": 1,
    "versionNonce": 15041,
    "isDeleted": false,
    "text": "Redis Session Store\nkey: abc -> { uid: 42 }",
    "fontSize": 10,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "Redis Session Store\nkey: abc -> { uid: 42 }",
    "containerId": "sess-redis"
  },
  {
    "id": "sess-note",
    "type": "rectangle",
    "x": 50,
    "y": 170,
    "width": 140,
    "height": 70,
    "strokeColor": "#64748b",
    "backgroundColor": "#f8fafc",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15042,
    "version": 1,
    "versionNonce": 15043,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "sess-note-text"
      }
    ]
  },
  {
    "id": "sess-note-text",
    "type": "text",
    "x": 60,
    "y": 188.125,
    "width": 120,
    "height": 33.75,
    "strokeColor": "#334155",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15044,
    "version": 1,
    "versionNonce": 15045,
    "isDeleted": false,
    "text": "Pros: Instant Revoke\nCons: Server Memory,\nRedis bottleneck",
    "fontSize": 9,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "Pros: Instant Revoke\nCons: Server Memory,\nRedis bottleneck",
    "containerId": "sess-note"
  },
  {
    "id": "jwt-box",
    "type": "rectangle",
    "x": 460,
    "y": 40,
    "width": 400,
    "height": 270,
    "strokeColor": "#10b981",
    "backgroundColor": "#ecfdf5",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15046,
    "version": 1,
    "versionNonce": 15047,
    "isDeleted": false
  },
  {
    "id": "jwt-box-text",
    "type": "text",
    "x": 490,
    "y": 191,
    "width": 340,
    "height": 28,
    "strokeColor": "#047857",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15048,
    "version": 1,
    "versionNonce": 15049,
    "isDeleted": false,
    "text": "Token-Based JWT (Stateless)",
    "fontSize": 13,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "Token-Based JWT (Stateless)",
    "containerId": "jwt-parts"
  },
  {
    "id": "jwt-client",
    "type": "rectangle",
    "x": 480,
    "y": 90,
    "width": 120,
    "height": 50,
    "strokeColor": "#059669",
    "backgroundColor": "#d1fae5",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15050,
    "version": 1,
    "versionNonce": 15051,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "jwt-client-text"
      }
    ]
  },
  {
    "id": "jwt-client-text",
    "type": "text",
    "x": 490,
    "y": 101,
    "width": 100,
    "height": 28,
    "strokeColor": "#065f46",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15052,
    "version": 1,
    "versionNonce": 15053,
    "isDeleted": false,
    "text": "Client\n(Bearer eyJhbGci...)",
    "fontSize": 10,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "Client\n(Bearer eyJhbGci...)",
    "containerId": "jwt-client"
  },
  {
    "id": "j-arr1",
    "type": "arrow",
    "x": 600,
    "y": 115,
    "width": 60,
    "height": 0,
    "strokeColor": "#059669",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "points": [
      [
        0,
        0
      ],
      [
        60,
        0
      ]
    ],
    "endArrowhead": "arrow",
    "seed": 15054,
    "version": 1,
    "versionNonce": 15055,
    "isDeleted": false
  },
  {
    "id": "jwt-server",
    "type": "rectangle",
    "x": 660,
    "y": 90,
    "width": 180,
    "height": 50,
    "strokeColor": "#059669",
    "backgroundColor": "#d1fae5",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15056,
    "version": 1,
    "versionNonce": 15057,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "jwt-server-text"
      }
    ]
  },
  {
    "id": "jwt-server-text",
    "type": "text",
    "x": 670,
    "y": 101,
    "width": 160,
    "height": 28,
    "strokeColor": "#065f46",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15058,
    "version": 1,
    "versionNonce": 15059,
    "isDeleted": false,
    "text": "Any API Node\nVerify Signature locally!",
    "fontSize": 10,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "Any API Node\nVerify Signature locally!",
    "containerId": "jwt-server"
  },
  {
    "id": "jwt-parts",
    "type": "rectangle",
    "x": 480,
    "y": 165,
    "width": 360,
    "height": 80,
    "strokeColor": "#8b5cf6",
    "backgroundColor": "#f3e8ff",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15060,
    "version": 1,
    "versionNonce": 15061,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "jwt-box-text"
      },
      {
        "type": "text",
        "id": "jwt-parts-text"
      }
    ]
  },
  {
    "id": "jwt-parts-text",
    "type": "text",
    "x": 490,
    "y": 186.25,
    "width": 340,
    "height": 37.5,
    "strokeColor": "#5b21b6",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15062,
    "version": 1,
    "versionNonce": 15063,
    "isDeleted": false,
    "text": "Header (Alg: RS256) . Payload (uid: 42, exp: 173000) . Signature\nPros: Zero DB lookups, Scales horizontally\nCons: Revocation needs Deny-list / Refresh rotation",
    "fontSize": 10,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "Header (Alg: RS256) . Payload (uid: 42, exp: 173000) . Signature\nPros: Zero DB lookups, Scales horizontally\nCons: Revocation needs Deny-list / Refresh rotation",
    "containerId": "jwt-parts"
  }
]

`JWT Token Security Architecture & Refresh Rotation`

JSON Web Tokens consist of three base64url-encoded parts: Header, Payload (Claims), and Cryptographic Signature. Because access tokens are stateless and cannot be easily revoked before expiration, systems use short-lived Access Tokens (15 min) paired with single-use Refresh Tokens (7 days).

XSS Mitigation: Store tokens in HttpOnly, Secure, SameSite=Strict cookies rather than localStorage
CSRF Mitigation: SameSite cookies + Anti-CSRF double-submit token headers
Revocation Strategy: Refresh Token Family rotation with automated token reuse detection

JWT Token Family Rotation & Reuse Compromise Detection in Node.js

A token rotation scheme that tracks refresh token families and revokes them all when reuse is detected.

3. OAuth 2.0 and OpenID Connect (OIDC)

OAuth 2.0 is a delegated authorization framework that allows third-party applications to obtain limited access to an HTTP service on behalf of a resource owner. OpenID Connect (OIDC) extends OAuth 2.0 by adding a standardized identity layer with ID Tokens.

OAuth 2.0 Authorization Code Flow with PKCE (RFC 7636)

System Design

Visualizing client challenge generation, authorization code exchange, and ID Token verification

100%

Rendering diagram…

sequenceDiagram
    autonumber
    actor User as User (Resource Owner)
    participant Client as Single Page App / Mobile (Client)
    participant AS as Authorization Server (IdP / OIDC)
    participant RS as Resource Server (API Gateway)

    User->>Client: Click "Login with SSO/OAuth"
    Client->>Client: Generate code_verifier & code_challenge (SHA-256)
    Client->>AS: Redirect to /authorize (client_id, code_challenge, scope, state)
    AS->>User: Display Consent & Login Screen
    User->>AS: Submit Credentials & Consent
    AS->>Client: Redirect to callback with authorization_code & state
    Client->>AS: POST /token (code, code_verifier, client_id)
    AS->>AS: Verify SHA-256(code_verifier) == code_challenge
    AS->>Client: Return access_token, id_token (JWT), & refresh_token
    Client->>RS: GET /api/user/profile (Authorization: Bearer access_token)
    RS->>RS: Verify JWT Signature locally (JWKS Public Key)
    RS->>Client: Return 200 OK with User Data

`OAuth 2.0 Core Roles & Grant Types`

Delegates resource access without sharing user passwords.

Resource Owner: The end-user who grants access
Client: The application requesting access (SPA, Mobile, Backend)
Authorization Server: Authenticates user and issues tokens (Auth0, Okta)
Resource Server: The API backend hosting protected resources
PKCE (Proof Key for Code Exchange): Eliminates auth code interception attacks on SPAs

`OpenID Connect (OIDC) Identity Layer`

Adds authentication on top of OAuth 2.0 authorization.

ID Token: A signed JWT containing user identity assertions (sub, email, name, exp)
UserInfo Endpoint: Protected REST endpoint returning detailed user profiles
Discovery Endpoint: /.well-known/openid-configuration publishing JWKS public keys

4. Single Sign-On (SSO) & Enterprise Identity Federation

Single Sign-On (SSO) allows users to authenticate once with a centralized Identity Provider (IdP) and gain seamless access to multiple independent applications (Service Providers) without re-entering credentials.

Single Sign-On (SSO) Identity Provider Federation Topology

System Design

Centralized identity validation across enterprise SaaS apps with SAML 2.0 & OIDC

100%

Rendering diagram…

flowchart TD
    User([User Browser]) --> App1[App 1: Jira]
    User --> App2[App 2: GitHub Enterprise]
    User --> App3[App 3: Internal HR Portal]

    subgraph "Centralized Identity Provider (IdP)"
        Okta[Okta / Auth0 / Azure AD]
        MFA[MFA / Biometric Engine]
        LDAP[(Corporate Directory / LDAP)]
        Okta --- MFA
        Okta --- LDAP
    end

    App1 -- 1. Unauthenticated Request --> Okta
    Okta -- 2. Authenticate & Verify MFA --> User
    Okta -- 3. Signed SAML Assertion / OIDC Token --> App1
    App2 -- 4. Single Sign-On (Session Active) --> Okta
    Okta -- 5. Immediate Access Granted --> App2
    App3 -- 6. Silent Token Refresh --> Okta
    Okta -- 7. Authorized Profile --> App3

    classDef idpStyle fill:#f3e8ff,stroke:#8b5cf6,stroke-width:2px,color:#5b21b6;
    classDef appStyle fill:#eff6ff,stroke:#3b82f6,stroke-width:2px,color:#1e40af;
    class Okta,MFA,LDAP idpStyle;
    class App1,App2,App3 appStyle;

`SAML 2.0 vs Modern OIDC SSO`

Enterprises traditionally use SAML 2.0 (Security Assertion Markup Language) with XML-based assertions signed by X.509 certificates. Modern cloud-native systems standardise on OIDC SSO due to lightweight JSON payloads, native mobile support, and seamless JWT integration.

Identity Provider (IdP): Okta, Azure AD (Entra ID), Ping Identity, Google Workspace
Service Provider (SP): The application (Slack, Jira, Salesforce, AWS Console)
Just-In-Time (JIT) Provisioning: Automatically creates user records in the SP upon first successful SSO login

5. API Rate Limiting Algorithms

Rate limiting defends APIs against denial-of-service, brute-force attacks, web scraping, and cascading failures by restricting the number of requests a client can submit within a timeframe.

Core API Rate Limiting Algorithm Topologies

System Design

Comparing Token Bucket, Leaky Bucket, Fixed Window, and Sliding Window mechanics

100%

Loading system design canvas…

[
  {
    "id": "rl-tb",
    "type": "rectangle",
    "x": 30,
    "y": 40,
    "width": 400,
    "height": 140,
    "strokeColor": "#2563eb",
    "backgroundColor": "#eff6ff",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15064,
    "version": 1,
    "versionNonce": 15065,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "rl-tb-text"
      }
    ]
  },
  {
    "id": "rl-tb-text",
    "type": "text",
    "x": 40,
    "y": 68.75,
    "width": 380,
    "height": 82.5,
    "strokeColor": "#1e40af",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15066,
    "version": 1,
    "versionNonce": 15067,
    "isDeleted": false,
    "text": "1. Token Bucket\n\n- Refill rate: r tokens/sec | Max Capacity: C\n- Each request consumes 1 token\n- Allows short bursts up to capacity C\n- Used by: AWS, Stripe",
    "fontSize": 11,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "1. Token Bucket\n\n- Refill rate: r tokens/sec | Max Capacity: C\n- Each request consumes 1 token\n- Allows short bursts up to capacity C\n- Used by: AWS, Stripe",
    "containerId": "rl-tb"
  },
  {
    "id": "rl-lb",
    "type": "rectangle",
    "x": 460,
    "y": 40,
    "width": 400,
    "height": 140,
    "strokeColor": "#059669",
    "backgroundColor": "#ecfdf5",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15068,
    "version": 1,
    "versionNonce": 15069,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "rl-lb-text"
      }
    ]
  },
  {
    "id": "rl-lb-text",
    "type": "text",
    "x": 470,
    "y": 68.75,
    "width": 380,
    "height": 82.5,
    "strokeColor": "#065f46",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15070,
    "version": 1,
    "versionNonce": 15071,
    "isDeleted": false,
    "text": "2. Leaky Bucket (FIFO Queue)\n\n- Requests enter queue of capacity C\n- Processed at constant fixed rate r req/sec\n- Smooths out bursts to steady output\n- Used by: Shopify, NGINX",
    "fontSize": 11,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "2. Leaky Bucket (FIFO Queue)\n\n- Requests enter queue of capacity C\n- Processed at constant fixed rate r req/sec\n- Smooths out bursts to steady output\n- Used by: Shopify, NGINX",
    "containerId": "rl-lb"
  },
  {
    "id": "rl-fw",
    "type": "rectangle",
    "x": 30,
    "y": 200,
    "width": 400,
    "height": 140,
    "strokeColor": "#d97706",
    "backgroundColor": "#fffbeb",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15072,
    "version": 1,
    "versionNonce": 15073,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "rl-fw-text"
      }
    ]
  },
  {
    "id": "rl-fw-text",
    "type": "text",
    "x": 40,
    "y": 228.75,
    "width": 380,
    "height": 82.5,
    "strokeColor": "#92400e",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15074,
    "version": 1,
    "versionNonce": 15075,
    "isDeleted": false,
    "text": "3. Fixed Window Counter\n\n- Fixed 1-minute time windows (12:00-12:01)\n- Counter resets at window boundary\n- Flaw: 2x burst traffic across boundaries!\n- Simple but risky for strict quotas",
    "fontSize": 11,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "3. Fixed Window Counter\n\n- Fixed 1-minute time windows (12:00-12:01)\n- Counter resets at window boundary\n- Flaw: 2x burst traffic across boundaries!\n- Simple but risky for strict quotas",
    "containerId": "rl-fw"
  },
  {
    "id": "rl-sw",
    "type": "rectangle",
    "x": 460,
    "y": 200,
    "width": 400,
    "height": 140,
    "strokeColor": "#8b5cf6",
    "backgroundColor": "#f3e8ff",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15076,
    "version": 1,
    "versionNonce": 15077,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "rl-sw-text"
      }
    ]
  },
  {
    "id": "rl-sw-text",
    "type": "text",
    "x": 470,
    "y": 228.75,
    "width": 380,
    "height": 82.5,
    "strokeColor": "#5b21b6",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15078,
    "version": 1,
    "versionNonce": 15079,
    "isDeleted": false,
    "text": "4. Sliding Window Log / Counter\n\n- Sliding log: Redis Sorted Set with timestamps\n- Sliding counter: Weighted avg of past & current\n- Prevents boundary burst exploits smoothly\n- Used by: Cloudflare, Cloud Gateways",
    "fontSize": 11,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "4. Sliding Window Log / Counter\n\n- Sliding log: Redis Sorted Set with timestamps\n- Sliding counter: Weighted avg of past & current\n- Prevents boundary burst exploits smoothly\n- Used by: Cloudflare, Cloud Gateways",
    "containerId": "rl-sw"
  }
]

`Token Bucket vs Leaky Bucket`

Token bucket refills tokens at rate r up to capacity C and allows bursts. Leaky bucket processes requests at a constant outflow rate, buffering bursts in a queue.

Token Bucket: Ideal for APIs that allow bursty traffic (AWS API Gateway)
Leaky Bucket: Ideal for systems requiring smooth, constant write throughput

`Fixed Window vs Sliding Window Counter`

Fixed window resets counters at fixed timestamps (risking 2x bursts at boundaries). Sliding window counter blends past and current window weights for accurate throttling.

Fixed Window Flaw: 100 reqs at 11:59 + 100 reqs at 12:00 = 200 reqs in 2 seconds!
Sliding Window Solution: Smooth rolling calculation across arbitrary 60-second windows

Distributed Sliding Window Rate Limiter (Atomic Redis Lua Script)

System Design

Visualizing ZREMRANGEBYSCORE timestamp pruning and atomic concurrency protection

100%

Rendering diagram…

sequenceDiagram
    autonumber
    participant Client as API Client
    participant GW as API Gateway / Rate Limiter
    participant Redis as Redis Cache (Sorted Set)
    participant API as Microservice Backend

    Client->>GW: HTTP Request (API Key: key_123)
    GW->>Redis: Execute Atomic Lua Script(key_123, now, limit=100, window=60s)
    activate Redis
    Redis->>Redis: ZREMRANGEBYSCORE key_123 0 (now - 60s)
    Redis->>Redis: ZCARD key_123 (Count active requests)
    alt Count < Limit
        Redis->>Redis: ZADD key_123 now now (Record current timestamp)
        Redis->>Redis: EXPIRE key_123 60
        Redis-->>GW: OK (Remaining: 100 - Count - 1)
        GW->>API: Forward Request
        API-->>Client: 200 OK (X-RateLimit-Remaining: 84)
    else Count >= Limit
        Redis-->>GW: REJECT (Retry-After: calculated_seconds)
        deactivate Redis
        GW-->>Client: 429 Too Many Requests (Retry-After: 12s)
    end

Distributed Sliding Window Rate Limiter with Atomic Redis Lua Script

A rate limiter that uses an atomic Redis Lua script to enforce a sliding window limit across distributed nodes.

6. API Keys, Secrets Management & Tiered Throttling

API keys authenticate machine-to-machine integrations. Never store raw API keys in plain text; instead, store one-way SHA-256 hashes and use standard HTTP headers to communicate rate limits.

`API Key Security Best Practices & Standard Headers`

Structure API keys with distinct prefixes (e.g. sk_live_abc123) for automated regex scanning in GitHub leak detection tools. Return RFC 6585 and IETF rate limit headers on every response.

X-RateLimit-Limit: Maximum permitted requests in the active window (e.g. 1000)
X-RateLimit-Remaining: Number of remaining requests permitted before rejection
X-RateLimit-Reset: Unix epoch timestamp when the quota resets
HTTP 429 Too Many Requests: Returned when quota is exceeded, paired with Retry-After header
Tiered Throttling: Free tier (10 req/min), Pro tier (1,000 req/min), Enterprise tier (100,000 req/min)

7. Encryption at Rest and in Transit (mTLS & Envelope Encryption)

Defense-in-depth requires encrypting data while moving across networks (In Transit) and when stored on persistent disks (At Rest).

Envelope Encryption Pattern (KMS Master Key KEK & Local DEK)

System Design

Decoupling data encryption from HSM hardware limits via two-tiered key hierarchies

100%

Loading system design canvas…

[
  {
    "id": "kms-node",
    "type": "rectangle",
    "x": 30,
    "y": 40,
    "width": 220,
    "height": 250,
    "strokeColor": "#dc2626",
    "backgroundColor": "#fef2f2",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15080,
    "version": 1,
    "versionNonce": 15081,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "kms-node-text"
      }
    ]
  },
  {
    "id": "kms-node-text",
    "type": "text",
    "x": 40,
    "y": 103.125,
    "width": 200,
    "height": 123.75,
    "strokeColor": "#991b1b",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15082,
    "version": 1,
    "versionNonce": 15083,
    "isDeleted": false,
    "text": "AWS KMS / Vault (HSM)\n\nStores Root KEK\n(Key Encryption Key)\nNever leaves HSM hardware!\n\nGenerates:\n- Plaintext DEK\n- Encrypted DEK",
    "fontSize": 11,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "AWS KMS / Vault (HSM)\n\nStores Root KEK\n(Key Encryption Key)\nNever leaves HSM hardware!\n\nGenerates:\n- Plaintext DEK\n- Encrypted DEK",
    "containerId": "kms-node"
  },
  {
    "id": "e-arr1",
    "type": "arrow",
    "x": 250,
    "y": 100,
    "width": 80,
    "height": 0,
    "strokeColor": "#dc2626",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "points": [
      [
        0,
        0
      ],
      [
        80,
        0
      ]
    ],
    "endArrowhead": "arrow",
    "seed": 15084,
    "version": 1,
    "versionNonce": 15085,
    "isDeleted": false
  },
  {
    "id": "e-arr2",
    "type": "arrow",
    "x": 330,
    "y": 130,
    "width": -80,
    "height": 0,
    "strokeColor": "#059669",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "points": [
      [
        0,
        0
      ],
      [
        -80,
        0
      ]
    ],
    "endArrowhead": "arrow",
    "seed": 15086,
    "version": 1,
    "versionNonce": 15087,
    "isDeleted": false
  },
  {
    "id": "app-enc-node",
    "type": "rectangle",
    "x": 330,
    "y": 40,
    "width": 260,
    "height": 250,
    "strokeColor": "#059669",
    "backgroundColor": "#ecfdf5",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15088,
    "version": 1,
    "versionNonce": 15089,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "app-enc-node-text"
      }
    ]
  },
  {
    "id": "app-enc-node-text",
    "type": "text",
    "x": 340,
    "y": 123.75,
    "width": 240,
    "height": 82.5,
    "strokeColor": "#065f46",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15090,
    "version": 1,
    "versionNonce": 15091,
    "isDeleted": false,
    "text": "Application Server\n\n1. Requests DEK from KMS\n2. Uses Plaintext DEK to encrypt data with AES-256-GCM\n3. Wipes Plaintext DEK from RAM immediately!\n4. Stores Encrypted DEK + Ciphertext",
    "fontSize": 11,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "Application Server\n\n1. Requests DEK from KMS\n2. Uses Plaintext DEK to encrypt data with AES-256-GCM\n3. Wipes Plaintext DEK from RAM immediately!\n4. Stores Encrypted DEK + Ciphertext",
    "containerId": "app-enc-node"
  },
  {
    "id": "e-arr3",
    "type": "arrow",
    "x": 590,
    "y": 165,
    "width": 70,
    "height": 0,
    "strokeColor": "#2563eb",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "points": [
      [
        0,
        0
      ],
      [
        70,
        0
      ]
    ],
    "endArrowhead": "arrow",
    "seed": 15092,
    "version": 1,
    "versionNonce": 15093,
    "isDeleted": false
  },
  {
    "id": "db-enc-node",
    "type": "rectangle",
    "x": 660,
    "y": 40,
    "width": 200,
    "height": 250,
    "strokeColor": "#2563eb",
    "backgroundColor": "#eff6ff",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15094,
    "version": 1,
    "versionNonce": 15095,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "db-enc-node-text"
      }
    ]
  },
  {
    "id": "db-enc-node-text",
    "type": "text",
    "x": 670,
    "y": 110,
    "width": 180,
    "height": 110,
    "strokeColor": "#1e40af",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15096,
    "version": 1,
    "versionNonce": 15097,
    "isDeleted": false,
    "text": "Database / S3 Storage\n\nStores:\n- Ciphertext Payload\n- Encrypted DEK (E-DEK)\n- IV / Auth Tag\n\nSafe even if DB is stolen!",
    "fontSize": 11,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "Database / S3 Storage\n\nStores:\n- Ciphertext Payload\n- Encrypted DEK (E-DEK)\n- IV / Auth Tag\n\nSafe even if DB is stolen!",
    "containerId": "db-enc-node"
  }
]

`Encryption in Transit (TLS 1.3 & mTLS)`

TLS 1.3 secures communication with 1-RTT handshakes and Ephemeral Diffie-Hellman (PFS) so compromised private keys cannot decrypt past recorded sessions.

TLS 1.3: Enforces Authenticated Encryption with Associated Data (AEAD) ciphers
mTLS (Mutual TLS): Both client and server present X.509 certificates for zero-trust microservice communication

`Encryption at Rest & Envelope Encryption`

Encrypting massive datasets directly with cloud HSMs is slow and throttled. Envelope encryption solves this by generating local single-use Data Encryption Keys (DEKs).

AES-256-GCM: Fast hardware-accelerated symmetric encryption with cryptographic integrity authentication
Key Encryption Key (KEK): Stored securely inside KMS/HSM to encrypt and decrypt DEKs

Mutual TLS (mTLS) Zero-Trust Microservice Mesh Flow

System Design

X.509 certificate validation, SPIFFE identity verification, and sidecar proxy encryption

100%

Rendering diagram…

sequenceDiagram
    autonumber
    participant SvcA as Order Service (Client)
    participant SvcB as Payment Service (Server)
    participant CA as Internal CA / HashiCorp Vault

    Note over SvcA,SvcB: Service Mesh Sidecars (Envoy / Istio)
    CA->>SvcA: Issue X.509 Client Cert + Private Key
    CA->>SvcB: Issue X.509 Server Cert + Private Key

    SvcA->>SvcB: Client Hello (Supported TLS 1.3 Ciphers)
    SvcB->>SvcA: Server Hello + Server X.509 Certificate
    SvcA->>SvcA: Verify Server Cert against Trusted CA Root
    SvcB->>SvcA: Certificate Request (Requests Client Identity)
    SvcA->>SvcB: Send Client X.509 Certificate + Signature
    SvcB->>SvcB: Verify Client Cert & Extract SPIFFE ID (e.g. spiffe://prod/order)
    SvcA->>SvcB: Key Exchange & Establish Encrypted Tunnel
    Note over SvcA,SvcB: Symmetric AES-GCM Encrypted Channel Established (Zero-Trust mTLS)
    SvcA->>SvcB: POST /charge-card (Payload strictly encrypted)

Envelope Encryption with AES-256-GCM & KMS Key Hierarchy in Node.js

An envelope encryption scheme that protects AES-256-GCM data keys under a KMS-managed key hierarchy.

8. DDoS Protection & Web Application Firewalls (WAF)

Distributed Denial of Service (DDoS) attacks attempt to exhaust network bandwidth, connection state tables, or CPU application compute. Mitigation requires multi-layered edge scrubbing.

Multi-Layered DDoS Defense Pipeline (Anycast Edge, Scrubbing & WAF)

System Design

Absorbing volumetric L3/L4 floods at CDN edges and filtering malicious L7 HTTP payloads

100%

Loading system design canvas…

[
  {
    "id": "ddos-attack",
    "type": "rectangle",
    "x": 30,
    "y": 100,
    "width": 130,
    "height": 80,
    "strokeColor": "#ef4444",
    "backgroundColor": "#fee2e2",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15098,
    "version": 1,
    "versionNonce": 15099,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "ddos-attack-text"
      }
    ]
  },
  {
    "id": "ddos-attack-text",
    "type": "text",
    "x": 40,
    "y": 126,
    "width": 110,
    "height": 28,
    "strokeColor": "#991b1b",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15100,
    "version": 1,
    "versionNonce": 15101,
    "isDeleted": false,
    "text": "Attacker Botnet\n(SYN Flood / HTTP Flood)",
    "fontSize": 10,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "Attacker Botnet\n(SYN Flood / HTTP Flood)",
    "containerId": "ddos-attack"
  },
  {
    "id": "d-arr1",
    "type": "arrow",
    "x": 160,
    "y": 140,
    "width": 60,
    "height": 0,
    "strokeColor": "#ef4444",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "points": [
      [
        0,
        0
      ],
      [
        60,
        0
      ]
    ],
    "endArrowhead": "arrow",
    "seed": 15102,
    "version": 1,
    "versionNonce": 15103,
    "isDeleted": false
  },
  {
    "id": "ddos-edge",
    "type": "rectangle",
    "x": 220,
    "y": 80,
    "width": 180,
    "height": 120,
    "strokeColor": "#d97706",
    "backgroundColor": "#fffbeb",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15104,
    "version": 1,
    "versionNonce": 15105,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "ddos-edge-text"
      }
    ]
  },
  {
    "id": "ddos-edge-text",
    "type": "text",
    "x": 230,
    "y": 108.75,
    "width": 160,
    "height": 62.5,
    "strokeColor": "#92400e",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15106,
    "version": 1,
    "versionNonce": 15107,
    "isDeleted": false,
    "text": "Edge / Anycast CDN\n(Cloudflare / Fastly)\n- Anycast IP Routing\n- SYN Cookies (L3/L4)\n- BGP Route Scrubbing",
    "fontSize": 10,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "Edge / Anycast CDN\n(Cloudflare / Fastly)\n- Anycast IP Routing\n- SYN Cookies (L3/L4)\n- BGP Route Scrubbing",
    "containerId": "ddos-edge"
  },
  {
    "id": "d-arr2",
    "type": "arrow",
    "x": 400,
    "y": 140,
    "width": 60,
    "height": 0,
    "strokeColor": "#059669",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "points": [
      [
        0,
        0
      ],
      [
        60,
        0
      ]
    ],
    "endArrowhead": "arrow",
    "seed": 15108,
    "version": 1,
    "versionNonce": 15109,
    "isDeleted": false
  },
  {
    "id": "ddos-waf",
    "type": "rectangle",
    "x": 460,
    "y": 80,
    "width": 180,
    "height": 120,
    "strokeColor": "#8b5cf6",
    "backgroundColor": "#f3e8ff",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15110,
    "version": 1,
    "versionNonce": 15111,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "ddos-waf-text"
      }
    ]
  },
  {
    "id": "ddos-waf-text",
    "type": "text",
    "x": 470,
    "y": 108.75,
    "width": 160,
    "height": 62.5,
    "strokeColor": "#5b21b6",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15112,
    "version": 1,
    "versionNonce": 15113,
    "isDeleted": false,
    "text": "Web App Firewall (WAF)\n- Rate Limiting\n- OWASP SQLi/XSS filters\n- Bot Challenge (CAPTCHA)\n- Geo-blocking & Rep",
    "fontSize": 10,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "Web App Firewall (WAF)\n- Rate Limiting\n- OWASP SQLi/XSS filters\n- Bot Challenge (CAPTCHA)\n- Geo-blocking & Rep",
    "containerId": "ddos-waf"
  },
  {
    "id": "d-arr3",
    "type": "arrow",
    "x": 640,
    "y": 140,
    "width": 60,
    "height": 0,
    "strokeColor": "#059669",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "points": [
      [
        0,
        0
      ],
      [
        60,
        0
      ]
    ],
    "endArrowhead": "arrow",
    "seed": 15114,
    "version": 1,
    "versionNonce": 15115,
    "isDeleted": false
  },
  {
    "id": "ddos-origin",
    "type": "rectangle",
    "x": 700,
    "y": 95,
    "width": 160,
    "height": 90,
    "strokeColor": "#10b981",
    "backgroundColor": "#ecfdf5",
    "fillStyle": "solid",
    "strokeWidth": 2,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "roundness": {
      "type": 3
    },
    "seed": 15116,
    "version": 1,
    "versionNonce": 15117,
    "isDeleted": false,
    "boundElements": [
      {
        "type": "text",
        "id": "ddos-origin-text"
      }
    ]
  },
  {
    "id": "ddos-origin-text",
    "type": "text",
    "x": 710,
    "y": 121.25,
    "width": 140,
    "height": 37.5,
    "strokeColor": "#047857",
    "backgroundColor": "transparent",
    "fillStyle": "solid",
    "strokeWidth": 1,
    "strokeStyle": "solid",
    "roughness": 0,
    "opacity": 100,
    "seed": 15118,
    "version": 1,
    "versionNonce": 15119,
    "isDeleted": false,
    "text": "Protected Origin Servers\n(Private VPC Subnet\nStrict IP Whitelist)",
    "fontSize": 10,
    "fontFamily": 5,
    "textAlign": "center",
    "verticalAlign": "middle",
    "originalText": "Protected Origin Servers\n(Private VPC Subnet\nStrict IP Whitelist)",
    "containerId": "ddos-origin"
  }
]

`Layer 3 & 4 (Network / Transport Layer) Attacks`

Aims to exhaust bandwidth and connection tables.

SYN Flood: Overwhelms TCP handshake queues; mitigated by SYN Cookies
UDP Amplification: Uses misconfigured DNS/NTP servers to reflect giant payloads
Anycast BGP Routing: Distributes attack traffic globally across hundreds of edge POPs

`Layer 7 (Application Layer) Attacks & WAF`

Aims to exhaust database threads and CPU memory.

HTTP Flood & Slowloris: Opens thousands of slow HTTP connections to tie up server sockets
Web Application Firewall (WAF): Inspects payloads for SQL Injection, XSS, CSRF, and bots
Managed Rules: OWASP Top 10 rule sets, Geo-blocking, and Managed IP reputation lists

9. Data Privacy, Governance & Compliance (GDPR Basics)

Regulatory frameworks like GDPR (General Data Protection Regulation) mandate strict technical controls around Personally Identifiable Information (PII), consent management, and data lifecycle disposal.

PII Tokenization & GDPR Crypto-Shredding Architecture

System Design

Enforcing Right to be Forgotten (Art. 17) across distributed data warehouses and backups via key disposal

100%

Rendering diagram…

flowchart LR
    User[User: Alice] --> API[API Gateway]
    API --> Vault[PII Tokenization Vault]
    
    subgraph KMS [Key Management Service]
        K_Alice[Alice's Unique Key: Key_UID_42]
        K_Bob[Bob's Unique Key: Key_UID_43]
    end

    Vault -- Encrypt with Key_UID_42 --> DB[(Encrypted Database)]
    Vault -- Store Token Ref: tok_alice_99 --> Analytics[(Analytics Data Warehouse)]

    subgraph "Right to be Forgotten (GDPR Art. 17)"
        Req[Alice requests account deletion] --> Purge[Delete Key_UID_42 from KMS]
        Purge -. "Crypto-Shredded: DB ciphertext is permanently unrecoverable!" .-> DB
    end

    classDef piiStyle fill:#fee2e2,stroke:#ef4444,stroke-width:2px,color:#991b1b;
    classDef keyStyle fill:#fef3c7,stroke:#d97706,stroke-width:2px,color:#92400e;
    classDef dbStyle fill:#eff6ff,stroke:#2563eb,stroke-width:2px,color:#1e40af;
    class Vault,Purge piiStyle;
    class K_Alice,K_Bob keyStyle;
    class DB,Analytics dbStyle;

`GDPR Technical Architecture Tenets`

Designing systems compliant with privacy by design and privacy by default.

Right to be Forgotten (Art. 17): Users can request full data deletion. Systems use "Crypto-Shredding" (destroying per-user encryption keys) to instantly render data unrecoverable in immutable backups and warehouses
Right of Access & Portability (Art. 15/20): Export all user-linked data in structured machine-readable formats (JSON/CSV)
Data Minimization (Art. 5): Collect only data strictly necessary for the stated purpose; automatically expire data via TTL policies
PII Tokenization Vaults: Replace raw identifiers (SSN, credit card, phone) with opaque surrogate tokens before writing to analytics logs

Knowledge Check

1. What is the primary difference between Authentication (AuthN) and Authorization (AuthZ)?

2. Why is PKCE (Proof Key for Code Exchange) recommended in OAuth 2.0 flows?

3. What flaw exists in the Fixed Window Counter rate limiting algorithm?

4. How does Envelope Encryption protect stored data at scale?

5. What is "Crypto-Shredding" in GDPR compliance?