Problem Statement & Context
How Problem Statement & Context shapes architecture and interviewer follow-ups for Design CAPTCHA System.
Problem Statement & Context
Design a multi-tenant CAPTCHA platform (Google reCAPTCHA / hCaptcha class) that raises bot automation cost while keeping humans flowing through login, signup, and checkout. This section focuses on why sites embed CAPTCHA at login, signup, and checkout without blocking humans.
- Anchor A: edge widget delivery before origin sees protected form submits
- Anchor B: multi-tenant SaaS with per-site keys and custom branding
- Anchor C: Google reCAPTCHA and hCaptcha compete on bot cost vs UX friction
Mechanism
A browser loads a signed widget config, renders either an invisible risk probe or an interactive puzzle, then exchanges a one-time proof token with the protected API. The origin never trusts client-side success flags—it only accepts server-side validated tokens bound to action, site key, and short TTL.
Interview phrasing
Lead with 8M verify/s global peak, 120ms p99 interactive solve path, 0.3% human false-block budget, and 99.95% token API availability.
Failure mode to volunteer
During a PoP cache poison, stale JS bundles serve broken widgets; you roll back CDN config version and pin integrity hashes while origin enforces fail-closed on signup until health restores.
| Signal | Target |
|---|---|
| Verify RPS | 8M/s |
| Interactive p99 | 120 ms |
| False block | <0.3% |
| Token TTL | 120 s |
1 public record SiteContext(String siteKey, String action, String remoteIp, String userAgent) {}
1 def challenge_ttl_seconds(difficulty: str) -> int: 2 return {"easy": 180, "hard": 90}.get(difficulty, 120)
1 export interface WidgetConfig { siteKey: string; action: string; mode: "invisible" | "checkbox" | "image"; }
Why interviewers care
CAPTCHA System interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.
Interview checkpoint
Name one failure story for Problem Statement & Context that proves you understand real outages, not happy-path diagrams.
Key Highlights
- •Problem Statement & Context: why sites embed CAPTCHA at login, signup, and checkout without blocking humans.
- •Mechanism emphasizes edge widget delivery before origin sees protected form submits
- •Ops angle: Google reCAPTCHA and hCaptcha compete on bot cost vs UX friction
Section Rescue Kit
Buzzwords to use:
Safe statements:
- "For Problem Statement & Context, I state verify RPS and human pass SLO before diagrams."
- "I separate control-plane policy from data-plane verify + Redis consume."