Authentication
78 bites tagged Authentication — interview questions with model answers, and 60-second explainers.
How to authenticate WebSocket connections using JWTs?
Client sends JWT on connection, server validates via middleware, socket is attached to user. WebSocket auth patterns and middleware understanding.
Session auth in Next.js with API routes and middleware
Login route sets a signed httpOnly cookie, middleware validates the session at the edge and redirects, server components read the session. Session flow on a hybrid framework.
localStorage vs httpOnly cookie for auth tokens
LocalStorage is JS-readable so XSS steals it; httpOnly cookies are JS-invisible blocking XSS theft but exposed to CSRF, mitigated by SameSite and tokens. Token storage security trade-offs.
Axios interceptors for auth headers
Interceptors are hooks that run before requests or after responses, centralizing concerns like auth, logging, and token refresh. cross-cutting request handling. attaching the token manually in every call site.
Structuring an auth flow in React Navigation
Conditionally render an auth stack versus app stack from state, not navigate calls; store token; let state drive screens. navigator structuring around auth state. navigating between stacks manually instead of swapping them.
OAuth2 social login with your own JWT
A login endpoint redirects to the provider with a state param, a callback exchanges the code for the provider token, you fetch the user profile, upsert the local user, then mint your own JWT. The authorization code flow end to end.
Secure refresh token flow for access renewal
Short-lived access token, longer-lived refresh token stored server-side, a refresh endpoint that validates and rotates the refresh token issuing a new pair. Designing the access plus refresh token pattern.
Revoking stateless JWTs on logout
A server-side denylist of revoked token IDs checked per request, or short-lived access tokens paired with revocable refresh tokens. Reconciling stateless tokens with real revocation.
Public API design versus internal API design
Public needs strict versioning, long deprecation, scoped auth like OAuth and API keys, and polished docs; internal can move faster. public APIs are long-lived contracts.
JWT login and protected route flow in Express
Verify credentials, sign a JWT, client stores and sends it (Authorization header or httpOnly cookie), middleware verifies signature on protected routes. end-to-end JWT auth flow and storage tradeoffs.
JWT storage: localStorage versus HttpOnly cookie
LocalStorage is JS-readable so XSS steals the token; HttpOnly cookies resist XSS theft but reintroduce CSRF, mitigated by SameSite plus CSRF tokens. Reasoning about XSS/CSRF trade-offs in token storage.
Explaining and preventing CSRF in Express
CSRF abuses a victim's ambient cookies to forge state-changing requests; the server issues an unpredictable token tied to the session, embeds it in forms, and validates it… Understanding CSRF and the synchronizer-token pattern.
Securing Express with Passport local strategy
Configure LocalStrategy with a verify callback, call passport.authenticate as route middleware, and set up serializeUser/deserializeUser for sessions. practical Passport.js wiring.
Session-based versus token-based authentication
Sessions store server-side state with a cookie id, tokens carry self-contained claims with no server store, weigh revocation versus scalability, especially across services. auth architecture trade-offs.
JWT structure and how the signature works
Name header, payload, and signature, note the first two are base64url-encoded not encrypted, explain the signature is computed over header and payload with a secret to detect tampering. understanding of JWT anatomy.
Authentication versus authorization in Express
Authentication proves who you are, authorization decides what you may do, authentication happens first. a core security vocabulary distinction.
Write a JWT authentication middleware
Read the header, strip Bearer, jwt.verify with the secret, set req.user and next(), else send 401. extracting a Bearer token, verifying it, and gating access. calling next() after sending 401, or trusting an unverified token.
Custom API key auth middleware
Read the header from req, on missing or invalid send res.status(401) and return, on valid call next, mount before protected routes. writing middleware with the req, res, next contract.
Defining SLIs and an SLO for an auth service?
Pick user-centric SLIs like login availability and latency, measure good over valid events at the right boundary, then set an achievable SLO with a window. Translating user needs into measured reliability.
Proposing availability and latency SLIs for an auth API
Availability as the ratio of successful valid requests; latency as the fraction served under a threshold; measure at the edge from the user's view. Designing measurable, user-centric SLIs.
Why store auth tokens in Keychain, not UserDefaults?
UserDefaults is an unencrypted plist readable from backups and on jailbroken devices; use Keychain Services, which stores encrypted items with access control; save with SecItemAdd and read with… secure credential storage.
Auth-protected routes via GoRouter redirect
A top-level redirect reads auth state, sends unauthenticated users to login, sends logged-in users away from login, and uses refreshListenable to re-evaluate on auth change. guarding routes with redirect.
How do you implement OAuth2 token refresh with Retrofit Authenticator?
Implement authenticate() with a blocking refresh, new Request with new token, Mutex for parallel 401s. Distinguishing Authenticator from Interceptor for 401 retry and sync.
Explain navigation guards and provide an auth use case
Guards are global, per-route, or in-component hooks; returning false cancels, a route object redirects; use auth on /dashboard. Grasp of routing lifecycle interception. Calling them listeners without mentioning returns.
Get Authentication bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.