Problems / Security, hard
Asked at Stripe, Cloudflare and Okta. A public API with a login endpoint sits behind only a load balancer. From 3 s scrapers send 5,000 requests a second, from 5 s credential stuffing sends 6,000 login attempts a second at the password-hashing service, and at 12 s a 40,000 requests-a-second flood arrives.
Unlock it once for 25 credits; everything inside it is free (runs, changes, Submit, results, hints). Sign in with Google to start; new accounts get free credits.
Success ≥ 98% for real users (some false positives are the price of blocking), p99 ≤ 800 ms, at least 95% of attack traffic blocked, for at most $40,000 a month.
Like a coding problem, a solution has to pass every case, not just the one it was built for. Submit in the lab runs all 6; 2 of them are hidden until then.
3,000 requests a second for 20 seconds: 85% api (reads), 15% login (writes).
What each component does in this design, and what calls it. The simulator mimics each one from these settings.
| Component | Its job here | Settings |
|---|---|---|
| Load balancerLoad balancer | Traffic enters here.Calls Public API.Layer 4 balancers route by IP and port; layer 7 balancers read HTTP and can route by path or header. | – |
| Public APIApp service | Load balancer forwards to it.Calls Auth (password hashing), Accounts and data (Postgres).Little's law: throughput ≈ concurrency ÷ latency. 200 slots at 50 ms serve about 4,000 req/s. | 10 replicas × 100 slots · timeout 1.0 s |
| Auth (password hashing)Auth / identity service | Public API calls it for /login.Short-lived access tokens plus refresh tokens limit the damage if a token leaks. | 400 slots |
| Accounts and data (Postgres)SQL database | Public API calls it.Postgres runs one process per connection, which is why poolers like PgBouncer sit in front of busy databases. | 16 vCPU · 400 connections · 1 read replicas |