Python &amp; FastAPI

What JWT claims must you validate beyond the signature?

This tests whether you understand token misuse beyond crypto: time validity, audience and issuer binding, algorithm whitelisting, and required claims enforcement. Red flag: only checking signature and ignoring exp or aud.

How do OAuth2 scopes enable granular permissions in FastAPI versus role-based checks?

Tests OAuth2 scope granularity vs RBAC and FastAPI SecurityScopes. Strong answers mention JWT claim strings, SecurityScopes per endpoint, and that RBAC is coarse while scopes are fine-grained. Red flag: treating scopes as roles or skipping claim checks.

Implement RBAC in FastAPI with a JWT role dependency

Build a dependency that decodes the JWT, checks the role, raises 403 if not admin, and inject via Depends.

Implement OAuth2 Password Flow in FastAPI

Tests FastAPI security integration and stateless auth patterns. A strong answer covers the POST /token endpoint returning a JWT, the OAuth2PasswordBearer dependency, and get_current_user decoding the JWT sub.

How should you store user passwords in a database?

Tests knowledge of slow salted hashing versus encryption. Strong answers pick Argon2id or bcrypt, require unique per-user salts, describe verification via re-hashing with constant-time comparison, and cite bcrypt or argon2-cffi.

What are the three components of a JWT?

Tests if you know JWT structure beyond library usage. A strong answer lists header, payload, and signature; notes Base64Url encoding; and gives a registered claim like exp. A red flag is confusing signing with encryption.

How do you protect a FastAPI endpoint using Depends and OAuth2PasswordBearer?

OAuth2PasswordBearer sets the token URL, Depends injects it into the endpoint, and FastAPI validates the Bearer header.

How do you atomically create an order and update inventory?

Tests transaction boundaries and SQLAlchemy 2.0 session lifecycle in FastAPI. A strong answer wraps both writes in session.begin(), flushes to catch constraint errors early, and uses exceptions to trigger rollback.

Implement a PATCH endpoint for partial SQLAlchemy updates

Tests PATCH vs PUT and selective ORM updates. Strong answer: all-optional update schema, load existing record, iterate exclude_unset=True fields with setattr, commit. Red flag: updating without excluding unset, which overwrites missing fields with None.

Why synchronous DB libraries block async FastAPI endpoints and correct SQLAlchemy usage

This tests event loop blocking: sync DB calls in async def halt all requests. Answer: sync drivers block the loop despite releasing the GIL; use asyncpg with SQLAlchemy create_async_engine and AsyncSession. Red flag: recommending run_in_executor as default.

How do you use FastAPI dependency injection for database sessions?

Build a generator dependency that yields a session and closes it after; inject via Depends(get_db).

Explain SQLAlchemy ORM vs Pydantic models in FastAPI

This tests separation of database schema from API contracts. A strong answer distinguishes SQLAlchemy table rows from Pydantic validation and OpenAPI generation, and notes that create schemas exclude auto-generated IDs.

Describe SQLAlchemy setup in FastAPI from database config to endpoint

Tests FastAPI dependency injection and SQLAlchemy session lifecycle. Good answers cover: engine with pooling, declarative models, a yield-based session dependency, and endpoint queries. Red flag: engine per request or global session shared everywhere.

Why are contextvars better than threading.local in async Python?

This tests whether you know async tasks share OS threads, making thread-local storage unsafe for request state. A great answer notes ContextVar is task-local and resets automatically, while threading.local bleeds across concurrent coroutines.

How do you gracefully cancel and clean up an asyncio task?

This tests asyncio cooperative cancellation and cleanup. A strong answer covers catching CancelledError at await points, using try/finally or async context managers for cleanup, and re-raising.

Unhandled exception in asyncio.create_task(): consequence and detection

Tests Task exception capture vs propagation. Good answer: exceptions are stored in the Task object, the loop keeps running, and the creator must await the task or call task.exception() to retrieve it; unretrieved ones may be logged.

When should you use asyncio.Lock over threading.Lock?

This tests cooperative multitasking knowledge: asyncio.Lock yields to the event loop via await, while threading.Lock blocks the OS thread and freezes the loop. A red flag is claiming threading.Lock works because locks are universal.

Explain the asyncio event loop and cooperative multitasking

Tests if you view the event loop as a single-threaded orchestrator, not magic parallelism. Strong answers note it runs tasks and callbacks, manages a ready queue, and yields control at await. Red flag: calling it multithreading or parallel execution.

How do you safely execute blocking code from an async function

Tests whether you know how to prevent event loop blocking by offloading sync work. Name asyncio.to_thread or run_in_executor, explain ThreadPoolExecutor scheduling, and note when processes beat threads.