Full Stack Developer
Authentication and authorization questions
33 questions on Authentication and authorization for full stack developers, easiest first.
Easy 6
Medium 12
- JWT in localStoragemedium
- CSRF with cookie sessionsmedium
- Hiding the button is not authmedium
- Rate limiter that does not limitmedium
- Serving private invoice PDFsmedium
- Sensitive data inside a JWTmedium
- Webhook signature always failsmedium
- Hard lockout after 5 failuresmedium
- Chance of guessing a 6-digit OTPmedium
- Token from another service acceptedmedium
- How long to guess a 4-digit PINmedium
- Removed admin still has accessmedium
Hard 15
- Refresh token rotationhard
- JWT algorithm confusionhard
- Redirect check that can be bypassedhard
- Profile update accepts any fieldhard
- Designing password reset linkshard
- OAuth for a browser-only apphard
- Why public clients use PKCEhard
- OAuth callback without statehard
- JWT key chosen by the kid headerhard
- SAML response with two assertionshard
- Lookalike usernamehard
- Linking accounts by emailhard
- Login is slower for real usershard
- Token with alg set to nonehard
- Loose redirect_uri matchinghard