● Covered by 1 source · 1 reportMedium impact1 neutral
Canva Redesigns Session Revocation Using Amazon S3 for Scalability
Key points
- Canva redesigned session revocation for hundreds of millions of sessions.
- New architecture uses Amazon S3 for immutable revocation records.
- Data distributed to gateways as in-memory indexes.
- Reduced memory footprint by 87.5% and improved deployment speed.
New Session Revocation Architecture
Canva has implemented a new session revocation infrastructure to manage hundreds of millions of active user sessions. The core of this redesign involves using Amazon S3 to store revocation data as compact, immutable records. These records are then distributed to application gateways, where they are used to build in-memory indexes for quick lookups.
Improvements and Benefits
This architectural shift has yielded several benefits for Canva. The company reported improved deployment speed and a reduction in the need for extensive database infrastructure. Furthermore, the memory footprint of its revocation cache was significantly reduced by 87.5%, indicating greater efficiency in resource utilization. The system avoids networked database lookups for most authentication requests, which was a key design goal.
Technical Implementation Details
Previously, Canva relied on MySQL for session refreshes and stored 12 hours of revocation data in memory. This led to high database load during deployments as hundreds of gateway instances requested millions of revocations. The new S3-based system divides the 12-hour revocation window into 30-minute S3 objects, which gateways download as needed. Each revocation is a 16-byte binary record. Gateways use conditional GETs to update changed chunks and discard old data. Asynchronous workers process new revocations, merge them, and upload results, with conditional PUTs and ZooKeeper leader election managing concurrency.
Scalability and Recovery
The design addresses scalability and recovery by allowing gateways to reconstruct their local revocation state by downloading relevant S3 chunks, eliminating the need for a database to rebuild the cache. The worker task can process over 2,000 revocations per second, exceeding Canva's requirements. Even a chunk containing one million revocations is approximately 16 megabytes, demonstrating the efficiency of the data storage.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
Canva re-engineered its session revocation infrastructure to handle hundreds of millions of active sessions by storing revocation data in Amazon S3 and distributing it as in-memory indexes to application gateways. This change improved deployment speed, reduced database infrastructure, and decreased the memory footprint of its revocation cache by 87.5%. The new architecture allows Canva to scale its authentication system more efficiently without relying on constant networked database lookups.