Everything that goes into building a correct, fast, safe backend service: HTTP and REST, auth, SQL, indexing, transactions, and the caching/queueing patterns that keep it standing up. Language- and vendor-agnostic.
You’re reading a free preview. Sign up to see every topic and question — and to play this deck as games.
Proving who a caller is and deciding what they may do: sessions versus tokens, how JWTs really work, cookie hardening, password storage, and the OAuth 2.0 / OpenID Connect flows worth knowing.
43 total questions
Card #1
What is the difference between authentication and authorization?
Card #2
How does server-side session authentication work?
Card #3
What are the three parts of a JWT?
1. A signed but unencrypted JWT is issued to a browser client. Which statement is true?
2. Which cookie attribute most directly limits token theft through cross-site scripting?
3. The chief operational drawback of stateless JWT access tokens is that they:
1. ___ establishes who a caller is, while authorization decides what that caller may do.
Hint: It always comes first
2. A JWT is made of three dot-separated parts: header, payload and ___.
Hint: The part that proves integrity
3. The ___ cookie attribute stops JavaScript reading the cookie, limiting the damage from XSS.
Hint: One word, camel case
