What is the difference between authentication and authorization? How would you implement both in an API?
What the interviewer wants to hear
- Authentication verifies who the user is
- Authorization decides what the user is allowed to do
- Sessions or tokens (JWT) for authentication; hashed passwords
- Role-based or permission checks on every protected endpoint, done on the server
- Correct 401 vs 403 responses
Model answer
Authentication answers who you are; authorization answers what you can do. For authentication, the user logs in with email and password, I check the password against a bcrypt or Argon2 hash, and then issue either a session cookie (HttpOnly, Secure) or a short-lived JWT with a refresh token. Middleware validates this on each request and attaches the user to the request. If it is missing or invalid, I return 401. For authorization, I check permissions on the server for every protected action, for example role-based access where only admins can delete users, plus ownership checks so a user can edit only their own posts. If the user is known but not allowed, I return 403. I never trust the frontend to hide buttons as the only protection.
Can you answer it under time pressure?
Take a timed easy round and get scored on every answer.
More easy Backend Developer questions
- How would you design a REST API for a simple blog with posts and comments? Mention URLs, methods and status codes.
- When would you choose a SQL database and when a NoSQL database?
- Explain what happens on the backend from the moment a request hits your server until a response is sent.
- What is a database index, and what are its costs? How do you decide which columns to index?
- What is a database transaction, and what do the letters in ACID mean? Give an example where you need one.
- What are logs, metrics and traces, and how would you use each one to run a backend service?
- How would you test a new POST /orders endpoint? Which kinds of tests would you write?
- Why do backend teams package services with Docker, and what makes a good Dockerfile?
- Explain the HTTP status code classes and give examples of codes a REST API commonly returns.