Security wants 7-day sessions. Here's the bill.

transcript

Security wants sessions to expire after 7 days, not 90. The candidate says: let me redo the numbers before I react.

18 million sessions over 90 days. About 200,000 expire a day. Over 7 days? About 2 point 57 million a day. If they all sign in again, daily OTPs triple. 1 point 2 million becomes 3 point 6.

Two SMS providers give 450 a second, together. The Diwali sale evening already needs 400. With 7-day sessions? About 1,200 a second. Nearly three times over.

Then the bill. 2 point 37 million extra SMS a day. At 18 paise each, about 4 point 3 lakh rupees a day. Roughly 1 point 3 crore rupees a month.

And a cliff. Apply it to existing sessions on day one? Every session older than 7 days dies at once.

So the candidate asks: what is security actually afraid of? A stolen refresh token? The device key already stops it. Add rotation. An old token shows up again? Revoke the whole family. Then roll out lazily, with jitter. Frozen before the sale.

The interviewer: you'd have to win that argument with numbers. 1,200 a second against 450. And 1 point 3 crore a month.

Full breakdown in the lecture.