Compare-and-Authenticate (CAA) is a tiny algorithm for centrally managing the validity of a set of distributed sessions. It currently has a single Go implementation found on GitHub.

In this article we’ll explore how we conceived of this solution given the problem and get into how it works in detail.

The Context

Whilst working with a previous startup client, we were tasked with porting everything from a very functional MVP Ruby codebase to Go with no noticeable service disruption.

The product was a geo-location recommendation engine for professional drivers in the form of an iOS and Android app. Both the apps and the service were free and had thousands of users at the time (this was 2016) of whom hundreds were active daily.

The backend system was in 2 parts when we joined: a ‘RESTful’ Ruby API for handling app requests and a Go service for dealing with geo-location recommendations. Both components shared a Postgres Database. All useful functionality in the app relied on API calls.

The Ruby service sat directly behind the mobile apps and managed sessions. The setup at this point was a long-lived JWT living on the mobile device itself, which had a payload as follows:

{
    "session_uuid": "...",