Session revocations at scale
Canva keeps 12 hours of session revocations in memory on every gateway, but hundreds of pods each loading over a million revocations from MySQL on deploy caused a stampede on the database. A worker now packs revocations into sorted 16-byte records in 30-minute chunks on S3, using conditional PUTs for optimistic concurrency and ZooKeeper leader election to avoid conflicts, and reaches over 2,000 revocations per second. Gateways binary-search the downloaded bytes directly and poll with conditional GETs, which shrank the cache by 87.5% and cut the revocation database down to two read replicas kept for redundancy.
- Published
- 2026-07-22
- Scale
- hundreds of millions of users, hundreds of thousands of session checks/sec, 2,000+ revocations/sec write throughput, 87.5% smaller in-memory cache
- Techniques
- caching object storage optimistic concurrency control binary encoding
- Stack
- MySQL Amazon S3 ZooKeeper Java
Try this stack yourself
- Railway · Deploy something like this on Railway: spin up MySQL plus your app in a few clicks. New accounts get $20 in credit (applied when you pick a paid plan).
Railway isn't part of Canva's setup in this story. It's just an easy place to try the same building blocks.
Some links above are affiliate links: if you sign up, How They Scaled may earn a commission at no extra cost to you. We only list tools that fit the stack in the story.