Security
How a system proves who is calling, decides what they may do, and protects data on the wire and on disk: passwords, sessions and tokens, OAuth, TLS, encryption keys, injection and secrets.
Overview
Security in system design is the set of choices that keep the wrong people out and the data intact: how callers prove who they are, what each one may do, and how data is protected while it travels and while it sits on disk. It is not a feature added at the end. The shape of the login flow, where tokens are checked and how keys are stored all show up in the architecture.
Most real breaches are not clever cryptography. The OWASP Top 10 for 2025 puts broken access control first: an API that returns someone else's order because nobody checked who owned it. Misconfiguration comes second. Both are design and review problems, which is why interviewers ask about them.
A good answer uses defense in depth: several independent layers, so one mistake does not expose everything. Encrypted transport, authentication at the edge, authorization in every service, least-privilege database accounts and encryption at rest each stop a different failure.
What you will be able to do
- Explain how to store passwords and why a fast hash such as SHA-256 is the wrong tool.
- Choose between server-side sessions and JWTs, and handle logout and revocation for each.
- Draw the OAuth 2.0 authorization code flow with PKCE, and say where OpenID Connect fits.
- Describe what TLS 1.3 protects, what mTLS adds, and how envelope encryption manages keys.
- Prevent injection, XSS and IDOR bugs with the standard defenses, and keep secrets out of code.
Key concepts
- Authentication vs authorization
- Password hashing
- Sessions and JWTs
- OAuth 2.0 and OpenID Connect
- PKCE
- Access control and IDOR
- TLS 1.3 and mTLS
- Envelope encryption
- Injection and XSS
- Zero trust
Interview questions
- How should a system store user passwords?
- Sessions or JWTs? How do you handle logout with JWTs?
- Walk through OAuth 2.0 with PKCE. How is OpenID Connect different?
- What is IDOR, and how do you design APIs to prevent it?
- What does TLS 1.3 give you, and when do you use mutual TLS?
- How would you encrypt sensitive data at rest, and where do the keys live?
- How do you prevent SQL injection and XSS?
- What does zero trust mean in practice for a microservices system?
Sign up free to read the full topic
More System Design topics
Start free on Cariara · Coding problems · System design studio