Introduction
Canva, a platform with over 100 million active users, faced a critical challenge: its session revocation pipeline was struggling to scale with the exponential growth of logged-in sessions. The existing system, designed for a smaller user base, began to degrade under load, manifesting as slow revocation times and increased latency during peak usage. This degradation wasn’t just a performance issue—it was a security risk. Delayed session revocation meant compromised accounts could remain active longer, exposing user data to unauthorized access. The root cause? A centralized database architecture that bottlenecked under high write throughput, as each revocation request required locking and updating a single record, causing contention and queueing delays.
The problem deepened with security concerns. Without efficient revocation, Canva risked session token reuse by malicious actors, even after logout. This vulnerability stemmed from the system’s inability to propagate revocation signals in real time across distributed servers, leaving a window for exploitation. Compounding this, the system’s high latency under load created a feedback loop: users experiencing slow logouts would retry, further congesting the pipeline and exacerbating delays. Canva’s challenge was clear: redesign the pipeline to scale horizontally, ensure immediate revocation, and maintain performance—all without compromising security.
The stakes were high. A failure to address this would not only erode user trust but also degrade system reliability, as resources were increasingly consumed by inefficient revocation processes. Canva’s solution, leveraging Amazon S3 for session management, emerged as a novel approach to these intertwined scalability and security issues. But why S3? And how did it address the mechanical failures of the previous system? The investigation reveals a causal chain: by decoupling revocation from a centralized database, Canva eliminated contention, while S3’s eventual consistency model and high throughput enabled near-instantaneous writes, breaking the feedback loop and securing sessions at scale.
Challenges and Requirements
Canva’s existing session revocation pipeline faced critical challenges as the platform scaled to hundreds of millions of users. The core issue was a centralized database architecture, which became a bottleneck under high write throughput. Each session revocation required locking and updating a single record, leading to contention and queueing delays. This mechanism caused a cascade of problems:
- Slow revocation: Delayed logout processing meant compromised accounts remained active longer, increasing the risk of unauthorized access. The causal chain was clear: delayed revocation → prolonged active sessions → heightened security risk.
- Performance degradation: High latency under load created a feedback loop: slow logouts → user retries → pipeline congestion → exacerbated delays. This loop not only frustrated users but also strained system resources, threatening overall reliability.
- Security vulnerabilities: Inefficient revocation allowed session token reuse by malicious actors. The inability to propagate revocation signals in real time across distributed servers left gaps for exploitation.
The redesigned system needed to address these issues by meeting the following requirements:
- Scalability: Eliminate the centralized bottleneck to handle high write throughput without contention. The solution must decouple revocation from the database to prevent locking and queueing delays.
- Security: Ensure near-instantaneous revocation to prevent session token reuse. The system must propagate revocation signals in real time across distributed servers.
- Performance: Break the feedback loop of slow logouts and user retries. The solution must maintain low latency even under peak load to preserve user experience and system reliability.
Canva’s choice of Amazon S3 as the solution was driven by its eventual consistency model and high write throughput. S3’s architecture allowed for near-instantaneous writes, eliminating contention and breaking the feedback loop. However, this solution has limitations: eventual consistency means revocation signals may not propagate instantly in all edge cases, though the risk is mitigated by S3’s typical sub-second consistency. If Canva’s user base grows beyond S3’s throughput limits or if stricter consistency is required, a hybrid approach with a distributed database might be necessary. The rule here is clear: if centralized bottlenecks cause contention → use a decoupled, high-throughput storage system like S3.
Solution: Leveraging S3 for Session Management
Canva’s redesign of its session revocation pipeline hinged on a critical architectural shift: replacing a centralized database with Amazon S3 as the backbone for session management. This decision was driven by the need to eliminate scalability bottlenecks, enhance security, and maintain performance under extreme load. Here’s how S3 addressed these challenges through its technical mechanisms:
1. Decoupling Revocation from Centralized Contention
The original system’s centralized database architecture became a physical bottleneck under high write throughput. Each session revocation required locking and updating a single record, leading to contention—a mechanical process where multiple threads compete for the same resource, causing queueing delays. This contention deformed the system’s performance, slowing revocation and creating a feedback loop of slow logouts, user retries, and pipeline congestion.
By migrating to S3, Canva decoupled revocation operations from a single point of contention. S3’s distributed architecture allows writes to be sharded across multiple storage nodes, eliminating the mechanical bottleneck. This decoupling breaks the feedback loop by enabling near-instantaneous writes, even under peak load.
2. S3’s Eventual Consistency Model: Trade-offs and Mechanisms
S3’s eventual consistency model was a key enabler for scalability. Unlike strong consistency, which requires all replicas to update before acknowledging a write, eventual consistency allows writes to propagate asynchronously. This reduces latency by avoiding cross-node synchronization, but introduces a risk of stale reads in edge cases.
In Canva’s context, this risk is mitigated by S3’s sub-second consistency—writes typically propagate within milliseconds. However, in rare cases, a revoked session might remain active for a brief period due to delayed propagation. This edge-case risk is acceptable given the orders-of-magnitude improvement in throughput and the reduced likelihood of session token reuse compared to the previous system.
3. High Throughput and Low Latency: Breaking the Feedback Loop
S3’s high write throughput directly addresses the performance degradation caused by the centralized database. By enabling parallel writes across nodes, S3 prevents the system from heating up under load—a metaphorical term for performance degradation due to resource exhaustion. This parallelism expands the system’s capacity to handle revocation requests, maintaining low latency even during peak usage.
The result is a causal chain: faster revocation → reduced session reuse risk → fewer user retries → decreased pipeline congestion. This chain reverses the feedback loop that previously exacerbated delays, restoring system reliability.
4. Security Enhancements: Near-Instantaneous Revocation
The centralized database’s slow revocation prolonged active sessions, increasing the risk of unauthorized access. S3’s architecture secures sessions at scale by enabling revocation signals to propagate rapidly. While eventual consistency introduces a theoretical risk of delayed revocation, S3’s sub-second consistency ensures that session tokens are effectively invalidated in real time, preventing reuse by malicious actors.
5. Decision Dominance: Why S3 Was the Optimal Choice
Canva considered alternatives like distributed databases but chose S3 for its proven scalability and cost-effectiveness. Distributed databases offer stronger consistency but introduce complexity and potential throughput limitations. S3’s eventual consistency was deemed acceptable given its sub-second propagation and the system’s tolerance for rare edge cases.
However, S3’s solution has limitations: if Canva’s throughput requirements exceed S3’s limits or stricter consistency is needed, a hybrid approach with a distributed database may be necessary. This decision rule applies: If S3’s throughput or consistency becomes insufficient → adopt a hybrid architecture.
Practical Insights and Typical Errors
- Error: Overlooking edge-case risks. While S3’s eventual consistency is generally acceptable, failing to monitor for delayed revocation in edge cases could reintroduce security vulnerabilities.
- Error: Ignoring future scalability. Choosing S3 without planning for potential throughput limits or consistency requirements could lead to a costly redesign later.
Canva’s approach demonstrates a rule for scalable session management: If centralized bottlenecks cause contention → use a decoupled, high-throughput storage system like S3, accepting eventual consistency for massive scalability gains.
Implementation and Impact: Canva’s S3-Powered Session Revocation Pipeline
Canva’s redesign of its session revocation pipeline, leveraging Amazon S3, addressed critical scalability and security challenges inherent in managing 100M+ user sessions. The implementation process involved a fundamental architectural shift from a centralized database to S3, driven by the need to eliminate contention and ensure near-instantaneous revocation. Here’s how it unfolded and the measurable impact it delivered.
Key Implementation Scenarios
- Decoupling Revocation from Centralized Contention
The original centralized database architecture forced every revocation request to lock and update a single record, creating a physical bottleneck. Under high write throughput, this led to contention, queueing delays, and slow revocation. By migrating to S3, Canva decoupled revocation from this bottleneck. S3’s distributed architecture sharded writes across multiple storage nodes, eliminating contention and enabling parallel processing. Mechanism: Parallel writes → reduced queueing delays → near-instantaneous revocation.
- Leveraging S3’s Eventual Consistency Model
S3’s eventual consistency allowed asynchronous write propagation, significantly reducing latency. While this introduced a risk of stale reads (e.g., a revoked session appearing valid for milliseconds), S3’s sub-second consistency mitigated this risk. Mechanism: Asynchronous writes → lower latency → acceptable edge-case risk for massive scalability gains.
- High Throughput and Low Latency Under Load
S3’s ability to handle parallel writes across nodes prevented performance degradation during peak loads. This broke the feedback loop of slow logouts, user retries, and pipeline congestion. Mechanism: Faster revocation → fewer retries → reduced congestion → sustained performance under extreme load.
Measurable Impact
| Metric | Before Redesign | After Redesign |
| Revocation Latency | Seconds to minutes under load | Sub-second consistency |
| Session Reuse Risk | High due to delayed revocation | Near-zero due to real-time invalidation |
| Pipeline Congestion | Frequent under peak load | Eliminated by parallel processing |
| User Experience | Slow logouts, retries, frustration | Seamless, instant logouts |
Decision Dominance: Why S3 Won Over Alternatives
Canva evaluated distributed databases but chose S3 for its proven scalability and cost-effectiveness. Distributed databases offer stronger consistency but introduce complexity and throughput limitations. Mechanism: S3’s eventual consistency + high throughput → optimal balance of scalability and security.
Rule for Scalable Session Management: If centralized bottlenecks cause contention, use a decoupled, high-throughput storage system like S3, accepting eventual consistency for massive scalability gains.
Practical Insights and Errors to Avoid
- Error 1: Ignoring Edge-Case Risks
S3’s eventual consistency introduces a brief risk of stale reads. Teams must acknowledge this edge case and ensure it’s acceptable for their use case. Mechanism: Stale reads → brief session delays → mitigated by sub-second consistency.
- Error 2: Overlooking Future Scalability Needs
If S3’s throughput limits are exceeded, a hybrid approach with a distributed database may be necessary. Failing to plan for this could require costly redesigns. Mechanism: Throughput limits → pipeline congestion → hybrid architecture as a future-proof solution.
Canva’s S3-powered session revocation pipeline not only resolved immediate scalability and security issues but also set a precedent for managing large-scale user sessions efficiently. By breaking the feedback loop of slow logouts and retries, Canva enhanced both system reliability and user trust, proving that innovative architectural shifts can deliver transformative results.
Top comments (0)