Canva’s in‑memory session revocation system scales to hundreds of millions
Canva stores encrypted session data in browser cookies and keeps a 12‑hour revocation list in memory, avoiding per‑request DB lookups. To stop deployment‑time cache stampedes, they switched from MySQL seeding to an S3‑backed cache, slashing startup latency while preserving sub‑millisecond revocation checks.