Authentication

Authentication interviews prove user identity through sessions, cookies, tokens, federated login, MFA, password hashing, and refresh-token lifecycle controls.

Subtopics: sessions and cookies, JWT/OAuth/OpenID Connect/SSO, and MFA with password hashing and refresh token rotation.

On interviews: compare server-side sessions with bearer tokens, explain OAuth/OIDC roles, and describe refresh rotation with replay detection.

Common pitfalls: long-lived access tokens, passwords stored incorrectly, MFA bypass on recovery flows, and trusting client claims without signature validation.

The trade-off is balancing simplicity, performance, safety, and operability — name which axis you optimized and what cost you accepted.

Checklist:

• Choose session vs token model for your clients.
• Set Secure, HttpOnly, SameSite on session cookies.
• Validate issuer, audience, expiry, and signature on tokens.
• Hash passwords adaptively; rotate refresh tokens on use.