Java Authentication
Proving who a caller is. Most of these questions are about tokens, and most wrong answers are about where to put them.
4 concepts · 12 interview questions
What this topic covers
Every concept in authentication, and the questions each one gets asked as. Where a question links, it has a full write-up.
Sessions versus tokens
A session id points at server-side state; a token carries the state itself. The difference decides how you scale and how you revoke.
- Session cookies or JWTs?
- Where should a browser store a token?
- How do you scale sessions across many instances?
JSON Web Tokens
A signed, base64-encoded claim set. Signed does not mean encrypted, and verification is the step people skip.
- What is inside a JWT, and what protects it?
- How do you revoke a JWT before it expires?
- What is the alg none attack?
OAuth 2 and OpenID Connect
OAuth 2 is a delegation framework for authorisation; OIDC adds an identity layer on top. Conflating them is the most common mistake in this area.
- What is the difference between OAuth 2 and OpenID Connect?
- Walk me through the authorisation code flow.
- Why is PKCE needed for public clients?
Passwords and credentials
Passwords are stored as slow, salted hashes so that a database leak does not immediately become an account takeover.
- How should a password be stored?
- Why is a salt necessary, and what does a pepper add?
- How do you handle a credential-stuffing attack?