Oliveyoung's Zero-Downtime OAuth2 Migration for a High-Traffic Legacy System

Oliveyoung set zero-downtime migration as its top priority while switching from Spring Session-based legacy authentication to OAuth2, ahead of Olyoung Sale, a massive traffic event. Rather than simply adopting a standard, the team first built a structure that protected the existing service's core functions and allowed an immediate rollback in case of failure.

At the center of the migration was the Feature Flag delegation pattern. FeatureFlagDelegatingInterceptor intercepts requests and, based on a flag value in the DB, chooses between the Legacy AuthenticationInterceptor and the JWT AuthenticationInterceptor to execute. This included staged verification targeting employees, exclusion of non-logged-in users, and automatic Legacy Fallback on error, enabling the authentication method to be switched safely at runtime.

Rollout was expanded gradually: 10% → 20% → 50% → 75% → 100%. Before the switch, tokens were issued in advance via Shadow Mode and pre-accumulated for users, minimizing logouts when actually switching over to token-based authentication. During the 2025.08.29~09.04 Olyoung Sale period, the system received 10x traffic compared to normal while maintaining a 100% success rate, with performance of P50 about 5ms, P75 about 35ms, P95 about 50ms, and CPU/memory at 30~35%.

The concurrency issue was solved with Jitter. Instead of a fixed 5-minute Access Token expiration time, it was randomized with ±30 seconds so that renewal requests wouldn't cluster at a specific point in time, resulting in a 40% reduction in Peak TPS, from 5,000 to 3,000. This distributed the spikes while maintaining the average TPS, securing time for Auto Scaling to respond.

Resilience4j Circuit Breaker was also applied to prepare for failures in the external Authorization Server. The circuit opens when the failure rate exceeds 50% or the slow call rate exceeds 50%, and after 30 seconds enters a half-open state, allowing only some requests through to verify recovery. This was combined with TimeLimiter(3 seconds) and Retry(up to 2 times) to protect core authentication paths—login, token renewal, logout, and device lookup—with multiple layers.

Ultimately, the core of this migration was not OAuth2 itself, but the combined design of a reversible structure, gradual per-user migration, traffic spike mitigation, and external failure isolation. Thanks to this combination, Oliveyoung was able to settle legacy authentication into OAuth2 without downtime even under extreme conditions like the sale period.