The Evolution of Session Management: Canva's Innovative Approach
The world of session management is undergoing a fascinating transformation, and Canva's recent architectural redesign is a prime example of this evolution. In a blog post, Canva's engineering team revealed their strategy to handle session revocations at an impressive scale, catering to hundreds of millions of active sessions.
What makes this particularly intriguing is Canva's decision to utilize Amazon S3 for storing revocation data, treating it as more than just an object store. This approach showcases a clever use of S3's capabilities, leveraging immutable objects and conditional writes as coordination primitives.
Redefining Scalability and Efficiency
Canva's previous setup involved storing 12 hours of revocation data in memory, with session refreshes relying on MySQL. As their platform expanded, this led to a significant database load, especially during deployments. Hundreds of gateway instances could request over a million revocations from MySQL, causing performance bottlenecks.
By opting for Amazon S3, Canva avoided the need for another datastore while ensuring durable storage. They divided the 12-hour revocation window into 30-minute S3 objects, which gateways download on-demand. This design choice not only reduces the memory footprint but also improves deployment speed and overall efficiency.
The Power of In-Memory Indexes
One of the standout features is the use of in-memory indexes. Canva stores session information in encrypted browser cookies, enabling gateways to authenticate requests without the overhead of networked datastore lookups. This approach significantly enhances performance and reduces latency.
The revocation data, represented as compact binary records, is efficiently searched using sorted arrays within the in-memory indexes. This optimization slashes the cache footprint, making the entire process lightning-fast. Gateways employ conditional GETs to fetch only the necessary data, further streamlining the process.
A Refreshing Take on Session Management
A Reddit discussion sparked an interesting debate, with a user suggesting a refresh token scheme as an alternative. However, Canva engineer Llew Vallis provided a compelling counterpoint, explaining that keeping revocation data in memory offers better trade-offs. Frequent token refreshes would strain the database and make availability contingent on the database during refresh operations.
Canva's new architecture proves its worth by reducing the session revocation database to just two read replicas, enhancing deployment speed, and making database load more predictable. This design choice aligns with the scalability requirements of a platform handling massive user sessions.
Implications and Future Trends
Canva's approach highlights a growing trend in the industry—the need for innovative session management strategies as applications scale to unprecedented levels. By sharing their insights, Canva contributes to the collective knowledge of the engineering community, inspiring others to rethink traditional approaches.
Personally, I find this a refreshing take on handling session revocations, demonstrating that sometimes, the best solutions involve rethinking fundamental design choices. It's a testament to the power of creative engineering and the importance of sharing these insights to drive the industry forward.
