An internal API currently trusts the user_id field in the POST body to identify the caller. This lets any client impersonate any user. Fix it with JWT authentication.
A JWT is a signed token issued at login that carries verifiable claims (such as user_id) without requiring a database lookup on every request — the server validates the cryptographic signature and extracts the identity from the token itself. The scaling benefit is real: auth without DB I/O means any instance can validate any token independently, which is essential in high-load or multi-service architectures. Use it for APIs and microservices where stateless auth is a priority; the trade-off is that revoking a token before it expires is harder, mitigated by using short-lived tokens or a revocation blocklist.
Evaluation criteria and weights will be revealed after you submit your solution. This ensures a fair assessment of your design skills.
Draw your architecture diagram, explain your design decisions, and get AI-powered feedback.
For the best experience, design challenges on a desktop or tablet — drawing the architecture on a phone is hard.