Backend Developer
Authentication and authorization questions
103 questions on Authentication and authorization for backend developers, easiest first.
Easy 32
- How to store passwordseasy
- 401 or 403easy
- What HttpOnly does on a cookieeasy
- Authentication versus authorizationeasy
- What a password salt is foreasy
- Is HTTP Basic auth encryptedeasy
- Sending an access token to an APIeasy
- What the Secure cookie flag doeseasy
- Header that goes with a 401easy
- Login error message wordingeasy
- What not to write to logseasy
- Modern password ruleseasy
- Rules for a login OTPeasy
- Weak point of SMS OTPeasy
- Which pair is really two factorseasy
- Permissions for a reporting serviceeasy
- Safe default for new API routeseasy
- The three parts of a JWTeasy
- Encrypting passwords instead of hashingeasy
- Login form on plain HTTPeasy
- Session id in the URLeasy
- Same email, different capital letterseasy
- What the server stores for a passkeyeasy
- Why cookie auth needs CSRF thoughteasy
- Log out of all deviceseasy
- API keys instead of a shared passwordeasy
- What a CAPTCHA protects againsteasy
- Which OAuth role issues tokenseasy
- What an OAuth scope iseasy
- OAuth flow to avoid in new appseasy
- Why apps use refresh tokenseasy
- What single sign-on meanseasy
Medium 41
- Logging out with JWTsmedium
- Why access tokens are short-livedmedium
- Any user can read any invoicemedium
- Raising the bcrypt cost from 10 to 12medium
- Session id stays the same after loginmedium
- What SameSite=Lax allowsmedium
- Cookie ignored in an embedded widgetmedium
- Cookie leaks to every subdomainmedium
- Idle and absolute session timeoutsmedium
- Logout that only clears the cookiemedium
- Credentialed requests with Allow-Origin *medium
- HS256 or RS256 for many servicesmedium
- Rotating JWT signing keys safelymedium
- Fresh tokens rejected as expiredmedium
- A token for one service works on anothermedium
- Reading the role from a tokenmedium
- Why OAuth uses a state parametermedium
- Using the ID token to call an APImedium
- OAuth flow for a nightly batch jobmedium
- Loose redirect URI matchingmedium
- How authenticator app codes workmedium
- Storing MFA backup codesmedium
- Role-based or attribute-based accessmedium
- Storing customer API keysmedium
- What a password pepper addsmedium
- Checking breached passwords privatelymedium
- Designing a remember-me cookiemedium
- What the __Host- cookie prefix needsmedium
- Data inside a signed cookiemedium
- Sessions after a password changemedium
- Kinds of privilege escalationmedium
- API key passed in the URLmedium
- Stopping replay of signed requestsmedium
- Rotating a shared API secretmedium
- Services proving their identitymedium
- Letting users change their emailmedium
- Re-checking identity before a transfermedium
- Logging in on a smart TVmedium
- Where a mobile app keeps tokensmedium
- Checking a Google ID token on the backendmedium
- Hiding salary in a GraphQL APImedium
Hard 30
- JWT verified with an attacker-chosen algorithmhard
- Two long passwords both workhard
- Upgrading old password hasheshard
- Login timing reveals real accountshard
- Locking accounts after 5 failureshard
- Logins from leaked password listshard
- Guessing an OTP with no attempt limithard
- Magic login links already usedhard
- Merging accounts by email from a login providerhard
- One company sees another's invoiceshard
- Removed admin can still delete usershard
- Revoking a stolen JWT earlyhard
- How PKCE's code challenge is madehard
- Another app catches the OAuth redirecthard
- Why passkeys stop phishinghard
- A huge SMS bill from the OTP endpointhard
- Two usernames that look identicalhard
- A 1 MB password slows the serverhard
- Making stolen access tokens uselesshard
- Keeping OAuth tokens out of the browserhard
- Permissions for shared documentshard
- An authorization code used twicehard
- Hundreds of roles that nobody understandshard
- Slow guessing from thousands of IPshard
- A user subdomain overrides your cookiehard
- An approve button inside a hidden framehard
- One token accepted by every servicehard
- Reset tokens in a leaked databasehard
- Logged in to the attacker's accounthard
- A reset link used twice at oncehard