Authentication and authorization interview questions
Sessions and tokens, JWT validation, refresh rotation, OAuth 2.0 with PKCE, OpenID Connect, password hashing, MFA, API keys, service identity and access control models.
– interview-ready · 12 questions in this topic
– of 12 tried
Saved on this device. Interview-ready means you got it right on two different days. Guesses and hints count for less.
Questions
- Server sessions vs stateless tokensPick the fix
- Validating a JWT properlyPredict
- Access tokens, refresh tokens and rotationOrder the steps
- OAuth 2.0 authorization code with PKCEOrder the steps
- OpenID Connect and ID tokensPick the fix
- Storing passwordsPredict
- MFA and TOTP codesPredict
- API keys done rightPick the fix
Practise this topic
Flashcards · 18
Flip, then say if you knew it. Needs JavaScript; every answer is also on its question page.
Quick quiz · 12 questions
One exercise per question, checked as you go. Needs JavaScript.
Mock interview · 2 sets
Timed, out loud, then tick what you covered. Needs JavaScript.
Quick facts
Recall the answer first, then tap Show to check.
JWT payloads
A signed JWT's payload is base64url, readable by anyone holding the token. Signing isn't encryption.
RFC 6238 vector
With secret 12345678901234567890 (SHA-1) at T = 59 s, the 8-digit TOTP is 94287082.
PKCE verifier length
RFC 7636: 43 to 128 characters; the S256 challenge is 43 characters.
bcrypt input limit
bcrypt uses only the first 72 bytes of the password.
Implicit flow
Deprecated by the OAuth 2.0 Security Best Current Practice; use authorization code with PKCE.
Token introspection
RFC 7662 lets a resource server ask the authorization server whether a token is active.
Printable cheat sheet · Review your weak spots in this topic
Share your progress
Sources: Topic outline informed by System Design Primer by Donne Martin and the Zalando RESTful API Guidelines, both licensed under CC BY 4.0. Every question and answer is written by Best Latest Apps. Credits and license