Authentication is often the first thing I want to break out of the application and backend anyway. Good password hashing is expensive... Why should an entire a

Authentication is often the first thing I want to break out of the application and backend anyway. Good password hashing is expensive... Why should an entire application have to go down when your login is being DDoSed? More so, A revocation list on something like Redis can expire with a token and a lot less expensive than an rdbms lookup with joins. Not too mention, why add extra load with extra DB calls in the first place? You don't have to be Google scale to want to separate logins from the main service. And that's just for starters.