What is the primary purpose of authentication?

Authentication is primarily about verifying who the user is.

What does a session cookie store?

A session cookie stores the session ID to identify the user.

What are the three parts of a JWT?

A JWT consists of a Header, Payload, and Signature.

What is the main function of OAuth 2.0?

OAuth 2.0 is primarily an authorization framework.

Which storage method is safest against XSS attacks?

HttpOnly Cookies cannot be accessed by JavaScript, making them safer.

What is a major risk of storing tokens in localStorage?

Tokens in localStorage can be accessed by any JavaScript, increasing risk.

What does HTTP being "stateless" mean for authentication?

HTTP is stateless — each request is independent, so sessions or tokens are required to identify the user across requests.

When a server sets a session cookie with `HttpOnly; Secure`, what does `HttpOnly` do?

HttpOnly prevents client-side JavaScript from reading the cookie, so even a successful XSS attack cannot steal the session ID.

A user logs out of a cookie-based session app. What should happen server-side?

Proper logout requires deleting the session from the server store so the session ID stored in the cookie is no longer valid.

In a cookie-based session, where is the actual user data (userId, email, etc.) stored?

The cookie holds only a session ID. Actual user data lives server-side in Redis or a database — the ID is just a key to look it up.

What is a major scaling challenge with cookie-based sessions?

In a multi-server setup each server has its own memory, so sticky sessions or a shared session store like Redis is needed.

The payload of a JWT is Base64-encoded. What does this mean for security?

Base64 is encoding, not encryption. Anyone can decode a JWT payload, so it must never contain passwords or secrets.

A JWT has been issued to a user who is then banned. What is the core challenge?

JWTs are stateless — the server keeps no record of issued tokens, so revocation requires a blocklist or very short expiry windows.

What is the `exp` claim in a JWT payload?

The `exp` claim holds the expiration time as a Unix timestamp; the server rejects any token received after that moment.

What does `Authorization: Bearer eyJhbGci...` in an HTTP request indicate?

The Bearer scheme is used to transmit JWT access tokens in the Authorization header for stateless API authentication.

What happens in the Refresh Token pattern when the Access Token expires?

Short-lived Access Tokens are silently refreshed using a long-lived Refresh Token, keeping users logged in without re-entering credentials.

In OAuth 2.0 Authorization Code Flow, what does the app receive first after the user consents?

The Authorization Server returns a short-lived Authorization Code to the redirect URI. The backend then exchanges it for tokens server-to-server.

Why should the OAuth `client_secret` never be placed in frontend JavaScript code?

The client_secret authenticates your application to the Authorization Server. Exposing it in client-side code lets attackers forge token requests as your app.

What is the `state` parameter used for in OAuth 2.0?

The `state` is a random value generated by the client before redirecting. After the callback the client verifies the returned state matches, blocking CSRF.

What is OpenID Connect (OIDC) in relation to OAuth 2.0?

OIDC builds on OAuth 2.0 by adding an ID Token (a JWT with user identity claims), enabling both authorization and authentication in one flow.

After completing the OAuth 2.0 flow and retrieving the user's Google profile, what should the backend do?

Google's Access Token is scoped to Google's APIs. Your backend should issue its own session or JWT so access is controlled by your app's auth system.

A user visits evil.com, which silently sends a request to yourapi.com where the user is already logged in via cookie. What attack is this, and why does it succeed?

CSRF exploits automatic cookie attachment. The forged request from evil.com carries the victim's session cookie to yourapi.com without their knowledge.

What does `SameSite=Strict` on a cookie do?

SameSite=Strict tells the browser to never attach the cookie to requests originating from a different site, blocking CSRF attacks entirely.

What is the recommended modern pattern for auth token storage in a browser-based app?

Keeping the Access Token in memory limits XSS exposure to the page session. The Refresh Token in an httpOnly cookie survives reloads without being readable by JS.

Which statement about localStorage vs httpOnly cookies is TRUE?

The HttpOnly flag instructs the browser to block all JavaScript access to the cookie, so even a successful XSS attack cannot exfiltrate the token.

What does the `Secure` flag on a cookie enforce?

The Secure flag prevents the browser from sending the cookie over plain HTTP, protecting it from network-level interception.

In a file storage app, a pre-signed URL for downloading a file expires in 5 minutes. What is the main benefit?

Pre-signed URLs embed credentials and an expiry into the URL itself — access is automatically revoked after the window closes without any extra server call.

Which best describes the difference between Authentication and Authorization?

Authentication answers "who are you?" (verifying identity). Authorization answers "what are you allowed to do?" (enforcing permissions on that identity).

A user modifies the JWT payload to change their role from "free" to "premium" and re-encodes it in Base64. Will the server accept it?

The JWT signature is an HMAC or RSA digest of the original header and payload. Changing even one byte produces a different digest, causing server-side verification to fail.

Authentication Fundamentals — System Design Concept

📚Authentication FundamentalsPro

16 sections

~41 min total

29 quick quizzes

0 of 16 done·~45 min left

Concepts›Authentication Fundamentals›What is Authentication?

0 / 16

16 sections~41 min

What is Authentication?

Authentication verifies user identity before granting access.

ReadQuizCode

~3 min

⋯

Cookie-Based Sessions vs JWT Tokens

Compare session management methods for user authentication.

Read

~3 min

⋯

🍪 Cookie-Based Sessions

Sessions store user data on the server, identified by cookies.

ReadQuizCode

~3 min

⋯

🔑 JWT Tokens (JSON Web Tokens)

JWTs are self-contained tokens that carry user information.

ReadQuizCode

~3 min

⋯

OAuth 2.0 and Social Login (Google, GitHub)

OAuth 2.0 enables third-party access without sharing passwords.

ReadQuiz

~3 min

⋯

🤔 What is OAuth 2.0?

OAuth 2.0 is an authorization framework for secure access.

ReadCode

~3 min

⋯

Token Storage: Memory vs localStorage vs httpOnly Cookie

Different storage options impact security and persistence.

ReadQuiz

~3 min

⋯

🤔 Why Does Storage Location Matter?

Storage location affects token accessibility and vulnerability.

ReadQuizCode

~3 min

⋯

Real-World Use Cases

Explore practical applications of authentication methods.

Read

~3 min

⋯

💼 Use Case 1: Interview Prep Platform

Authentication needs for a platform focused on interview preparation.

ReadCode

~3 min

⋯

📋 Use Case 2: Job Application Tracker

Session management for tracking job applications.

ReadCode

~3 min

⋯

📁 Use Case 3: File Storage (like Google Drive clone)

OAuth and JWT for secure file storage access.

ReadQuizCode

~3 min

⋯

📊 Authentication Decision Flowchart

A flowchart to guide authentication method selection.

ReadCode

~3 min

⋯

MCQ Practice Questions

Multiple choice questions to test understanding of authentication.

Read

~3 min

⋯

🎯 Quick Revision Cheat Sheet

A concise summary of key authentication concepts.

Read

~3 min

⋯

Practice test

29 questions

~10 min

🔒

Pro content

Authentication Fundamentals is a Pro concept. Upgrade to access full content, practice questions, and design challenges.

Upgrade to Pro →

Notes

🔍

Loading…