Authentication
19 practice items · needed by 7 roles
Easy 3Medium 9Hard 7
Practice questions
- Where to keep a session tokenmedium
- How to store passwordseasy
- What HttpOnly does on a cookieeasy
- Logging out with JWTsmedium
- Why access tokens are short-livedmedium
- Storing user passwordseasy
- JWT in localStoragemedium
- CSRF with cookie sessionsmedium
- Sensitive data inside a JWTmedium
- Refresh token rotationhard
- JWT algorithm confusionhard
- Redirect check that can be bypassedhard
- Designing password reset linkshard
- OAuth for a browser-only apphard
- Parallel token refresh logs users outhard
- Tampering with a JWThard
- Tests fail after an hourmedium
- Tests for several user rolesmedium
- Blocking paste in password fieldsmedium