Back to the Catalog
system-design
security
http

Auth & Sessions at Scale

12 questions

Authentication is where security and system design collide. This quiz contrasts stateful sessions with stateless JWTs, then digs into the consequences: where to store tokens (httpOnly cookie vs. localStorage and the XSS/CSRF tradeoff), refresh-token rotation, revocation and logout-everywhere (the hard part of stateless auth), short-lived access tokens, and multi-device/multi-tab coordination. Grounded in the specs: RFC 7519 (JWT), RFC 6749 (OAuth 2.0), RFC 7636 (PKCE), RFC 9700 (OAuth Security BCP), and OpenID Connect Core.

Start

Questions

  1. Not answered. What is the defining tradeoff of a stateless JWT versus a server-side session?
  2. Not answered. A JWT is three base64url segments joined by dots: header.payload.____. Name the third segment.
  3. Not answered. Which statements about where you store an auth token in the browser are correct?
  4. Not answered. You authenticate with a session cookie. Which measure most directly mitigates CSRF?
  5. Not answered. With refresh-token rotation, a client presents a refresh token that was already used (and rotated away). What should the server do?
  6. Not answered. Why keep access tokens short-lived (minutes) while refresh tokens live for days?
  7. Not answered. You use stateless JWT access tokens and need "log out everywhere" to take effect quickly. Which approaches actually accomplish that?
  8. Not answered. What does OpenID Connect (OIDC) add on top of OAuth 2.0?
  9. Not answered. Why do public clients (SPAs, mobile apps) use the Authorization Code flow with PKCE instead of the old Implicit flow?
  10. Not answered. Your fleet validates JWTs and intermittently rejects freshly issued tokens as "not yet valid" or "expired," depending on which server handles the request. Most likely cause and fix?
  11. Not answered. Your SPA is open in three tabs. One tab refreshes the access token, rotating the refresh token. How should the other tabs avoid a stale token and a refresh stampede?
  12. Not answered. Which registered JWT claim is a unique identifier for an individual token — the natural key for building a revocation denylist?