Auth and Security

Auth and security interviews treat authentication, authorization, browser defenses, and application security as explicit backend trust boundaries—not optional headers.

Child sections: authentication, authorization, web security, and application security.

On interviews: separate proving identity from deciding access, walk through session vs token flows, and name defenses for injection, CSRF, and SSRF on a concrete endpoint.

Common pitfalls: JWT as session without revocation, RBAC labels without resource checks, and security middleware without validation at boundaries.

The trade-off is balancing simplicity, performance, safety, and operability — name which axis you optimized and what cost you accepted.

Checklist:

• Authenticate once; authorize close to protected resources.
• Use secure cookies or validated tokens with rotation.
• Layer browser defenses: CORS, CSP, secure headers.
• Operate with OWASP awareness, rate limits, and audit logs.