Authentication & Authorisation interview questions

Sessions versus tokens, OAuth 2 and OIDC flows, JWT validation pitfalls, and RBAC versus ABAC.

3 questions in Backend Engineering.

Backend EngineeringA 28-minute read on how the topic fits together, before the questions.Backend engineering fundamentals56 short answers on one page, for revising rather than studying.

hard3

hardScenarioDesign

A maintenance script updates your permissions table and every user in one tenant can suddenly edit everything. What should have stopped that, and how would you have found out?

Permission data is as privileged as the code that reads it, so a bulk write to it needs the same review, staged rollout and reversibility as a deploy. Derive grants from a source of truth rather than stamping them, assert tenant invariants continuously, and know how long a cached decision keeps the mistake alive.

6 minsenior, staff, lead

hardDesignConcept

Customers want per-project roles rather than one global role. How do you model that, and where in the request does the check happen?

Model permission as a relationship between a subject, a role and a specific resource, not as a role stamped on the user, and push the check down into the data access predicate so a list query and a single-record fetch are authorised by the same rule.

6 minmid, senior, staff, lead

hardConceptDesign

Would you use server-side sessions or JWTs for authenticating your API, and why?

Default to server-side sessions in an opaque HttpOnly cookie, because revocation is a row delete and the browser cannot read the credential. Choose JWTs only when a resource server must validate without calling the issuer, keep them short-lived, and pin the algorithm, issuer, audience and expiry on every verification.

5 minmid, senior, staff