Skip to lesson
Exit
Deep Dive - Authentication Architecture1 / 2

2 min lesson

Design exercise: secure the editor

Rebuild the sequence in "Design exercise: secure the editor" from memory, ending with the check that proves the outcome.

Step 1 of 2

Time to assemble the pieces into one design you can present and defend. This is the shape the system-design deep-dive takes and rehearsing it end to end is how you walk in with a structure instead of improvising under pressure.

The prompt

"Design authentication for the Cursor editor: a native desktop app connecting a million-plus daily users to our backend services and to SCM providers like GitHub, with org-level access control. Walk me through it."

Open by restating constraints and naming the flow, so the panel knows you've placed the problem: public native client, 1M+ DAU, auth on every request, multi-tenant orgs, third-party SCM. Then march through the lifecycle.

  1. 1Login. Authorization Code + PKCE in the system browser; exact-match redirect, state for CSRF, least-privilege scopes. Enterprise tenants federate to their IdP over OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition./SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition..
  2. 2Issuance & storage. Mint a short-lived access JWT (~10 min, RS256) plus a refresh token. Store tokens in the OS secure storage (Keychain / Credential Manager / libsecret), never plaintext on disk.
  3. 3Serve requests. Verify the access JWT locally on the hot path - no per-request DB hit. Claims carry user id, org and coarse role.
  4. 4Refresh & revoke. Rotate refresh tokens with reuse detection; check token_version at refresh so revocation lands within one access TTL. Keep a deny-list for emergency log-out-now.
  5. 5Authorize. RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition. for org/team roles in claims; a ReBAC layer for per-repo sharing. SCM access uses separately-scoped OAuth tokens to GitHub/GitLab, stored and refreshed independently.
  6. 6Rate limit. Throttle token and refresh endpoints per client and per IP; auth endpoints are a favorite target for credential stuffing.