Authentication
78 bites tagged Authentication — interview questions with model answers, and 60-second explainers.
Vercel Connect replaces env tokens with runtime OIDC
Vercel Connect Public Beta replaces static env tokens with short-lived, task-scoped credentials exchanged at runtime via OIDC. Agents request least-privilege access per job instead of holding long-lived shared secrets, eliminating manual rotation when…
How would you design auth for ISR pages without losing cache benefits?
Tests cache segmentation and dynamic boundaries in Next.js. Propose a static ISR shell for anonymous users, then fetch personalized data client-side or via dynamic server paths when cookies are present.
How can you use Edge Middleware for auth and trade-offs versus getServerSideProps?
Middleware checks cookies/JWT for fast Edge rewrites/redirects; getServerSideProps uses full Node.js for heavy sessions with colder starts. Auth placement judgment. Claiming Edge Middleware can query a database directly.
Describe a robust automatic token refresh strategy in a React SPA
This tests token rotation without UX interruption in SPAs. Use HttpOnly cookies for refresh tokens, in-memory access tokens, an interceptor with a promise lock, and proactive background refresh.
How would you implement a basic protected route in React?
Hold auth in useState, pass user to protected components, and return Navigate to login when absent. Whether you can gate React Router 7 routes declaratively.
What is Next.js Middleware and a real-world auth use case?
This tests request interception before a route renders. A good answer defines Middleware as pre-request code using NextRequest and NextResponse, often on the Edge Runtime, with auth redirects as an example.
How would you use Next.js Middleware to protect /api/admin/* routes?
Match /api/admin/:path*, read the secure cookie, validate the token, return 401 or proceed. Edge auth and why client session objects cannot secure API routes. Using useSession or the client session object in Middleware.
Cypress auth strategies: UI login vs programmatic session
Tests your grasp of Cypress test isolation and speed tradeoffs. A strong answer contrasts slow UI login (ideal for the auth flow itself) against programmatic auth via cy.request or cy.session (fast setup for protected routes).
Implement a protected /dashboard route in React Router
Tests declarative route guards versus imperative redirects in React Router 7. Strong answer: reusable ProtectedRoute wrapper with Navigate replace, auth state above Routes, and role checks.
Protected Routes: Server Gates, Not Hidden Links
A protected route is a server-enforced gate, not a hidden link. In Next.js, middleware or server components validate sessions before HTML ships, which matters for dashboards and billing.
How do you authenticate a FastAPI WebSocket connection?
This tests WebSocket limits and FastAPI dependency injection. Pass the JWT via query parameter or cookie at handshake, validate it with Depends, and reject with HTTP 403 or 1008 close.
How do you test a FastAPI endpoint without real tokens?
Tests whether you know FastAPI's dependency override mechanism to isolate business logic from auth. A great answer describes using app.dependency_overrides to swap the auth Depends for a mock returning a fake user, then cleaning up after the test.
What JWT claims must you validate beyond the signature?
This tests whether you understand token misuse beyond crypto: time validity, audience and issuer binding, algorithm whitelisting, and required claims enforcement. Red flag: only checking signature and ignoring exp or aud.
How should you store user passwords in a database?
Tests knowledge of slow salted hashing versus encryption. Strong answers pick Argon2id or bcrypt, require unique per-user salts, describe verification via re-hashing with constant-time comparison, and cite bcrypt or argon2-cffi.
What are the three components of a JWT?
Tests if you know JWT structure beyond library usage. A strong answer lists header, payload, and signature; notes Base64Url encoding; and gives a registered claim like exp. A red flag is confusing signing with encryption.
How do you protect a FastAPI endpoint using Depends and OAuth2PasswordBearer?
OAuth2PasswordBearer sets the token URL, Depends injects it into the endpoint, and FastAPI validates the Bearer header. your grasp of FastAPI dependency injection for security.
How do you create a reusable current-user dependency in FastAPI?
Tests DRY auth with FastAPI Depends. Answer: create get_current_user that Depends on OAuth2PasswordBearer, verifies token, returns User model, inject into routes. Red flag: middleware or manual header parsing in each endpoint.
JWT: Signed JSON Claim Tokens
A JWT is a signed JSON envelope: it carries claim assertions in JSON, optionally encrypted, and proves who wrote it using either a private secret or a public/private key. Do not treat the payload as hidden unless encryption is actually enabled.
JWT Authentication: Signed Claims, Not Sessions
A JWT is a signed JSON blob that lets a server trust a client without storing session state. Express APIs use it to stay stateless across load-balanced servers. The footgun is stuffing secrets inside because the payload is only Base64, not encrypted.
Walk me through a magic link login system and its security considerations
Tests auth architecture and threat modeling for passwordless flows. Strong answers map request-token-email-verify-session, then harden with short expiry, single-use tokens, rate limits, and device binding.
Explain Dio interceptors and automatic token refresh
Define interceptors as hooks; queue concurrent 401s during refresh; retry with Bearer header via token manager. Stateful middleware and async orchestration. Synchronous refresh or refresh storms.
Implement OAuth 2.0 flow to get an access token for API requests
Tests your grasp of OAuth 2.0 grant-type selection and token lifecycle. Strong answers match the script context to client credentials or authorization code flow, detail the token endpoint exchange, and address refresh and expiry.
Draft a JSON error response for an invalid authentication token
Tests your ability to standardize API error contracts with RFC 7807. A strong answer returns 401 with type, title, detail, and instance, plus an actionable fix like re-authenticating. Red flag: 403, echoing the token, or exposing stack traces.
Explain SPF, DKIM, and DMARC roles and implementation tasks
SPF authorizes IPs, DKIM signs content, DMARC aligns both to the From domain and enforces policy plus reporting. Your grasp of layered email auth and operational deployment.
Get Authentication bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.