Auth & Sessions at Scale

Authentication is where security and system design collide. This quiz contrasts stateful sessions with stateless JWTs, then digs into the consequences: where to store tokens (httpOnly cookie vs. localStorage and the XSS/CSRF tradeoff), refresh-token rotation, revocation and logout-everywhere (the hard part of stateless auth), short-lived access tokens, and multi-device/multi-tab coordination. Grounded in the specs: RFC 7519 (JWT), RFC 6749 (OAuth 2.0), RFC 7636 (PKCE), RFC 9700 (OAuth Security BCP), and OpenID Connect Core.