Authentication
78 bites tagged Authentication: interview questions with model answers, and 60-second explainers.
Test yourself: Top 30 Authentication interview questions →Multiple choice, with the correct answer and why it is correct on every question. Free, no sign-in.How to authenticate WebSocket connections using JWTs?
Client sends JWT on connection, server validates via middleware, socket is attached to user.
Session auth in Next.js with API routes and middleware
Login route sets a signed httpOnly cookie, middleware validates the session at the edge and redirects, server components read the session.
localStorage vs httpOnly cookie for auth tokens
LocalStorage is JS-readable so XSS steals it; httpOnly cookies are JS-invisible blocking XSS theft but exposed to CSRF, mitigated by SameSite and tokens.
Axios interceptors for auth headers
Interceptors are hooks that run before requests or after responses, centralizing concerns like auth, logging, and token refresh.
Structuring an auth flow in React Navigation
Conditionally render an auth stack versus app stack from state, not navigate calls; store token; let state drive screens.
OAuth2 social login with your own JWT
A login endpoint redirects to the provider with a state param, a callback exchanges the code for the provider token, you fetch the user profile, upsert the local user, then mint your own JWT.
Secure refresh token flow for access renewal
Short-lived access token, longer-lived refresh token stored server-side, a refresh endpoint that validates and rotates the refresh token issuing a new pair.
Revoking stateless JWTs on logout
A server-side denylist of revoked token IDs checked per request, or short-lived access tokens paired with revocable refresh tokens.
Public API design versus internal API design
Public needs strict versioning, long deprecation, scoped auth like OAuth and API keys, and polished docs; internal can move faster.
JWT login and protected route flow in Express
Verify credentials, sign a JWT, client stores and sends it (Authorization header or httpOnly cookie), middleware verifies signature on protected routes.
JWT storage: localStorage versus HttpOnly cookie
LocalStorage is JS-readable so XSS steals the token; HttpOnly cookies resist XSS theft but reintroduce CSRF, mitigated by SameSite plus CSRF tokens.
Explaining and preventing CSRF in Express
CSRF abuses a victim's ambient cookies to forge state-changing requests; the server issues an unpredictable token tied to the session, embeds it in forms, and validates it…
Securing Express with Passport local strategy
Configure LocalStrategy with a verify callback, call passport.authenticate as route middleware, and set up serializeUser/deserializeUser for sessions.
Session-based versus token-based authentication
Sessions store server-side state with a cookie id, tokens carry self-contained claims with no server store, weigh revocation versus scalability, especially across services.
JWT structure and how the signature works
Name header, payload, and signature, note the first two are base64url-encoded not encrypted, explain the signature is computed over header and payload with a secret to detect tampering.
Authentication versus authorization in Express
Authentication proves who you are, authorization decides what you may do, authentication happens first.
Write a JWT authentication middleware
Read the header, strip Bearer, jwt.verify with the secret, set req.user and next(), else send 401.
Custom API key auth middleware
Read the header from req, on missing or invalid send res.status(401) and return, on valid call next, mount before protected routes.
Defining SLIs and an SLO for an auth service?
Pick user-centric SLIs like login availability and latency, measure good over valid events at the right boundary, then set an achievable SLO with a window.
Proposing availability and latency SLIs for an auth API
Availability as the ratio of successful valid requests; latency as the fraction served under a threshold; measure at the edge from the user's view.
Why store auth tokens in Keychain, not UserDefaults?
UserDefaults is an unencrypted plist readable from backups and on jailbroken devices; use Keychain Services, which stores encrypted items with access control; save with SecItemAdd and read with…
Auth-protected routes via GoRouter redirect
A top-level redirect reads auth state, sends unauthenticated users to login, sends logged-in users away from login, and uses refreshListenable to re-evaluate on auth change.
How do you implement OAuth2 token refresh with Retrofit Authenticator?
Implement authenticate() with a blocking refresh, new Request with new token, Mutex for parallel 401s.
Explain navigation guards and provide an auth use case
Guards are global, per-route, or in-component hooks; returning false cancels, a route object redirects; use auth on /dashboard.
Get Authentication bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.