Top 30 Authentication Interview Questions and Answers

Question 1

When an app running on Vercel requests a provider token through Vercel Connect at runtime, how does it prove its identity?

Accepted Answer

By using the OIDC identity that every Vercel deployment automatically receives

Answer

By prompting the user for an OAuth consent flow on each request

Answer

By sending a long-lived Vercel API token from the project settings

Answer

By presenting a static provider secret stored in environment variables

Question 2

Why is conditionally rendering separate auth and app stacks preferred over calling navigation.navigate after login?

Accepted Answer

State drives which screens exist, so the old stack is unmounted and unreachable

Answer

It avoids needing to persist the auth token anywhere

Answer

It lets back navigation return to the login screen for convenience

Answer

navigate is deprecated in modern React Navigation versions

Question 3

For an auth API availability SLI, why should legitimate 401 responses for wrong passwords be excluded from the failure count?

Accepted Answer

Because they represent the system working correctly, not an outage, so counting them penalizes correct behavior

Answer

Because 401 responses are always caused by network errors

Answer

Because client errors are impossible to measure at the edge

Answer

Because only 5xx codes can be measured by load balancers

Question 4

In FastAPI, which approach best implements a reusable current-user check that preserves OpenAPI docs integration and keeps endpoints testable?

Accepted Answer

Define a get_current_user dependency that uses OAuth2PasswordBearer, validates the token, returns a User model, and inject it into routes with Depends.

Answer

Return the raw token string from a dependency and let each endpoint query the database for the user.

Answer

Manually read request.headers.get("Authorization") inside every endpoint and decode the JWT there.

Answer

Create a middleware that parses the Authorization header and stores the user in request.state.

Question 5

A Python daemon runs nightly without user interaction to pull API data on its own behalf. Which OAuth 2.0 approach should it use to obtain an access token?

Accepted Answer

Use the client credentials grant, authenticating directly to the token endpoint with its client_id and client_secret.

Answer

Use the resource owner password credentials grant, exchanging a service account username and password at the token endpoint.

Answer

Use the authorization code grant, redirecting a user to the authorization endpoint and storing a refresh token for later runs.

Answer

Use the implicit flow, receiving an access token directly from the authorization endpoint via browser redirect.

Question 6

Why would an application use a presigned URL instead of proxying a private file download through its own server?

Accepted Answer

To reduce server load and improve efficiency by offloading file transfer.

Answer

To provide permanent, unrestricted access to the file.

Answer

To enable complex, multi-file access control for different user roles.

Answer

To allow the client to authenticate directly with the cloud provider.

Question 7

Which scenario best illustrates the appropriate use case for OAuth 2.0 authentication compared to a simple API key?

Accepted Answer

A mobile application requesting access to a user's social media profile on a third-party platform.

Answer

An API requiring a static secret string to be sent with every request for basic access control.

Answer

A backend service communicating with another trusted internal microservice.

Answer

An API providing public, read-only weather data without user-specific information.

Question 8

What is the primary security concern when using docker login with a username and password directly in CI/CD pipelines?

Accepted Answer

The credentials may be exposed in build logs or stored unencrypted.

Answer

It prevents the use of multiple registries within a single pipeline.

Answer

It requires manual intervention, which defeats automation.

Answer

It can lead to token expiration issues that halt the pipeline.

Question 9

How should a ProtectedRoute wrapper preserve the original destination when redirecting an unauthenticated user from /dashboard to login?

Accepted Answer

Pass the current location via the state prop on the Navigate component

Answer

Append the original path as a query parameter to the login URL

Answer

Set the replace prop on Navigate to remember the intended destination

Answer

Save the original URL in localStorage before performing the redirect

Question 10

Why must auth middleware return after sending res.status(401) when the key is invalid?

Accepted Answer

To stop execution so it does not also call next and trigger a double response

Answer

Because res.status throws unless followed by return

Answer

To reset the response status back to 200

Answer

To free the API key from memory immediately

Question 11

What is the main advantage of using conditional navigators for authentication in React Native?

Accepted Answer

It ensures a clear separation of navigation history, preventing authenticated users from returning to login screens.

Answer

It dynamically loads screen components, reducing the initial bundle size for users.

Answer

It allows for conditional rendering of UI elements within screens based on user permissions.

Answer

It simplifies the process of managing user session tokens and authentication state.

Question 12

Your JWT middleware sends a 401 for bad tokens but crashes with 'Cannot set headers after they are sent'. What is the bug?

Accepted Answer

It calls next() after sending the 401 response

Answer

It uses jwt.verify instead of jwt.decode

Answer

It attaches the payload to req.user

Answer

The secret is read from an environment variable

Question 13

What bug occurs if a request interceptor injects a header but forgets to return the config object?

Accepted Answer

Axios sends the request with an undefined config, likely throwing or losing all options

Answer

Axios silently skips the interceptor and sends the original request unchanged

Answer

The header is added twice, duplicating the Authorization value

Answer

The response interceptor runs before the request interceptor to compensate

Question 14

A SaaS team is building a revenue dashboard in Next.js App Router. They need to ensure unauthenticated users never receive sensitive HTML or data, while avoiding unnecessary edge latency. Which approach aligns with best practices?

Accepted Answer

Use lightweight middleware to catch requests without a session cookie, then validate the token in a server component before fetching data.

Answer

Check localStorage for a token in the root layout and conditionally render the dashboard on the client.

Answer

Hide the dashboard link in the navigation and redirect unauthenticated users with a client-side useEffect hook.

Answer

Validate the session in edge middleware with a heavy database lookup on every /dashboard request, and render a fallback UI on the client.

Question 15

Why is storing an authentication token in UserDefaults considered insecure even though apps are sandboxed?

Accepted Answer

UserDefaults writes to an unencrypted plist that appears in backups and is readable on jailbroken devices

Answer

UserDefaults has a size limit that truncates tokens

Answer

UserDefaults is shared across all apps on the device by default

Answer

UserDefaults only works while the app is in the foreground

Question 16

Which approach best secures draft previews on a production frontend while preserving realistic content rendering?

Accepted Answer

Verify the editor via edge middleware, then request the draft through a scoped preview API at request time

Answer

Use client-side data fetching with a long-lived preview token shipped in the bundle

Answer

Serve draft responses through the production CDN cache to improve origin performance

Answer

Generate static deploy previews for drafts behind unguessable URL paths

Question 17

What is the primary security advantage of Multi-Factor Authentication (MFA) compared to relying solely on a strong password?

Accepted Answer

It ensures that even if a password is compromised, an attacker still needs an additional, different type of credential to gain access.

Answer

It automatically detects and blocks all malicious login attempts before they reach the password stage.

Answer

It forces users to regularly update their passwords to new, unique combinations.

Answer

It makes passwords immune to being guessed or exposed in data breaches.

Question 18

Which pattern best solves the secret zero problem for an app retrieving secrets from Vault in a Kubernetes cluster?

Accepted Answer

Use a projected service account token to authenticate to Vault via the Kubernetes auth method, obtaining a short-lived token through an init container or sidecar

Answer

Distribute a unique TLS client certificate to each pod via a config map and have Vault verify the certificate subject for every secret request

Answer

Embed a wrapped Vault token directly into the container image during the CI build so the app can unwrap it at runtime

Answer

Store a long-lived Vault root token in a Kubernetes Secret mounted as an environment variable for the app to use at startup

Question 19

What is the primary function of the Identity Provider (IdP) within a Single Sign-On (SSO) architecture?

Accepted Answer

To authenticate the user once and then issue a cryptographically signed assertion that Service Providers trust.

Answer

To act as a central proxy, routing all user requests to the appropriate Service Provider.

Answer

To enforce granular access control policies for every feature within each Service Provider.

Answer

To store and manage all user data, including application-specific settings, across all connected services.

Question 20

When deploying DMARC, which statement accurately describes how it interacts with SPF and DKIM during validation?

Accepted Answer

DMARC requires at least one aligned pass from SPF or DKIM, linking the result to the From header domain.

Answer

DMARC only evaluates DKIM alignment because SPF frequently fails on forwarded messages and mailing lists.

Answer

DMARC replaces SPF and DKIM by performing its own IP validation and cryptographic signature checks.

Answer

DMARC requires both SPF and DKIM to pass for every message, aligning checks against the envelope sender domain.

Question 21

What is the primary way Identity Federation enables a single login for multiple services?

Accepted Answer

It allows services to delegate user authentication to a trusted central provider.

Answer

It replicates user accounts and passwords to each service for consistent access.

Answer

It creates a universal user profile that all services can directly access and modify.

Answer

It encrypts all user credentials, making them securely transferable between services.

Question 22

A user logs in successfully, then requests an admin-only endpoint and is rejected. Which HTTP status best fits, and why?

Accepted Answer

403 Forbidden, because they are authenticated but lack permission

Answer

404 Not Found, to hide the endpoint

Answer

400 Bad Request, because the role is missing

Answer

401 Unauthorized, because their token is invalid

Question 23

An attacker decodes a JWT, edits the role claim to admin, and re-encodes it without the secret. What happens at verification?

Accepted Answer

Verification fails because the signature no longer matches the altered payload

Answer

It is accepted because the payload is valid base64url

Answer

It is accepted until the token expires

Answer

The server cannot read the payload since it is encrypted

Question 24

When three parallel Dio requests return 401 due to an expired access token, how should an interceptor handle refresh and retries?

Accepted Answer

Lock the queue, perform one async refresh, then let all queued requests resume with the new token

Answer

Refresh the token once, retry only the first request, and drop the remaining queued requests

Answer

Check token expiry synchronously in onRequest and refresh the token before any request is sent

Answer

Let each 401 independently trigger its own refresh call and race to update the shared token manager

Question 25

Across five stateless Express instances behind a load balancer, what is the main operational cost of choosing session-based auth over JWTs?

Accepted Answer

You need a shared session store so any instance can resolve the session

Answer

Sessions require asymmetric keys on every node

Answer

Sessions cannot work with more than one server

Answer

Sessions expose the user id in the cookie

Question 26

In a Passport local strategy verify callback, what is the correct way to signal a successful authentication?

Accepted Answer

return done(null, user)

Answer

return done(null, true)

Answer

return done(user)

Answer

return done(true, user)

Question 27

What does FastAPI automatically do when you inject an OAuth2PasswordBearer instance into an endpoint using Depends?

Accepted Answer

Expect a Bearer token in the Authorization header, return 401 if absent, and add security metadata to OpenAPI docs

Answer

Require manual inspection of request.headers inside the endpoint to find the Bearer token

Answer

Hash incoming passwords and generate JWTs using the configured tokenUrl

Answer

Verify the token against a database and inject the current user into the endpoint function

Question 28

In a secure magic link flow, what must the server do immediately after validating the token?

Accepted Answer

Immediately mark the token consumed and invalidate it before establishing the session

Answer

Convert the valid token into a long-lived JWT session credential

Answer

Allow a brief idempotent reuse window to accommodate accidental double-clicks

Answer

Extend the token's remaining TTL to match the new session length

Question 29

Which statement accurately describes the structure and security properties of a typical signed JWT's three dot-separated parts?

Accepted Answer

The header specifies the algorithm and token type, the payload carries visible claims such as exp, and the signature provides integrity but not confidentiality.

Answer

The payload defines the signing algorithm, the header holds user claims, and the signature is an encrypted hash that hides the payload content.

Answer

The header stores the server secret, the payload is encrypted by default, and the signature proves the user's identity to the client.

Answer

All three parts are Base64Url-encrypted so only the server can read them, the signature is optional, and the payload contains the shared secret.

Question 30

Which storage and verification approach best protects passwords during a total database breach?

Accepted Answer

Hashing with bcrypt using a unique salt per password and constant-time comparison on login

Answer

Hashing with SHA-256 using a unique random salt per user and comparing with standard string equality

Answer

Encrypting passwords with AES-256 so they can be recovered when users forget them

Answer

Hashing with bcrypt using a single global salt and comparing with standard string equality