80%
Auth & Web Security Sessions, JWT, OAuth, hashing, OWASP Top 10, CORS, CSP0/25 questions known
1. Authentication vs authorization
DefinitionAuthentication = who are you? (login).
RBAC: permissions by role (admin, doctor, patient).
Always check ownership too: "can this user see *this* order?" — missing checks cause IDOR bugs.
Authorize on the server for every request; hiding a button is not security.
2. Storing passwords
Use slow, salted algorithms: argon2id or bcrypt.
Rate-limit login and OTP endpoints; lock out or add delays after failures.
Same error for "no such user" and "wrong password" (no user enumeration).
Offer MFA (TOTP / passkeys) for sensitive apps.
3. Sessions vs JWT
State: stored on the server (Redis/DB); cookie holds only an id · claims inside a signed token
Logout / revoke: easy: delete the session · hard: valid until it expires
Scaling: needs a shared store · any server can verify the signature
Best for: classic web apps · APIs, mobile, microservices
FlowAccess + refresh token patternLogin→Short access token (15 min) + refresh token (httpOnly cookie)→Access expires→POST /refresh → rotate refresh token→Logout → revoke refresh token
Common mistakeJWTs are signed, not encrypted — never put secrets in the payload.
4. OAuth 2.0 and OpenID Connect
OAuth 2.0 lets an app act on a user's behalf without their password (authorization).
App redirects to the provider with client_id, redirect_uri, scope, state and a PKCE challenge.
User logs in and consents.
Provider redirects back with a one-time code.
Server exchanges the code (+ PKCE verifier) for tokens.
TipUse the Authorization Code flow with PKCE; state protects against CSRF on the callback.
5. Common attacks (OWASP)
XSS: attacker script runs in your page · escape output (React does), avoid dangerouslySetInnerHTML or sanitise (DOMPurify), CSP, httpOnly cookies
CSRF: another site makes the browser send a request with your cookies · SameSite=Lax/Strict cookies, CSRF tokens, check Origin
SQL / NoSQL injection: input changes the query · parameterised queries / ORM, validate types, reject $ operators in input
Broken access control / IDOR: /orders/124 shows someone else's order · check ownership on every request
6. Browser security: CORS, cookies, headers
DefinitionSame-origin policy: a page can only read responses from the same scheme + host + port.
Non-simple requests (JSON body, custom headers, PUT/DELETE) trigger a preflight OPTIONS request.
Credentialed requests can't use *; list exact origins.
Cookie flags: HttpOnly (no JS access), Secure (HTTPS only), SameSite=Lax (CSRF defence).
Headers: HSTS, CSP, X-Content-Type-Options: nosniff, Referrer-Policy — helmet sets sensible defaults.
ReviseHash passwords with argon2/bcrypt, short access + rotating refresh tokens in httpOnly cookies, authorize every request (ownership!), parameterised…
Most asked (9)
QWhat is the difference between authentication and authorisation?Authentication (authn) answers who are you? It verifies identity: password, passkey, OTP, SSO login.
QSession cookies vs JWTs: how do they work and which would you choose?Server sessions: after login the server stores session data (in Redis or a DB) and sends a random session ID in a cookie.
QWhat is inside a JWT, and how is it verified?A JWT is three Base64URL parts joined by dots: header.payload.signature.
QWhere should you store a JWT in the browser: localStorage or a cookie?localStorage: easy to send in an Authorization header, and immune to CSRF.
QHow should passwords be stored?Never store plain text or use encryption (reversible) or a fast hash like MD5 or SHA-256: GPUs try billions of guesses per second.
QWhat is XSS, and how do you prevent it?Cross-site scripting: an attacker gets their JavaScript to run in your site's pages, in other users' browsers.
QWhat is CSRF, and how do you prevent it?Cross-site request forgery: a malicious site makes the victim's browser send a request to your site, and the browser attaches the victim's…
QWhat is SQL injection (and NoSQL injection), and how do you prevent it?Injection happens when user input is concatenated into a query, so the input changes the query's structure.
QExplain the cookie flags HttpOnly, Secure and SameSite.- HttpOnly: JavaScript (document.cookie) cannot read the cookie, so XSS cannot steal it - Secure: only sent over HTTPS, never in plain HTTP…