Authentication

Question 1

What is the difference between authentication and authorization?

Answer 1

• Authentication verifies the user’s identity (e.g., login credentials).
• Authorization determines what actions or resources the authenticated user has access to.

Question 2

What is session-based authentication, and how does it work?

Answer 2

A server creates a session for the user after login and stores a session ID in a browser cookie. The server verifies the session ID for subsequent requests.

Question 3

How does token-based authentication work?

Answer 3

The server issues a token (e.g., JWT) upon login. The client includes this token in the headers of future requests for authentication.

Question 4

What are the components of a JSON Web Token (JWT)?

Answer 4

• Header: Contains the algorithm and token type.
• Payload: Includes claims (user data, permissions).
• Signature: Verifies the token’s integrity.

Question 5

What is OAuth 2.0, and what is its primary use case?

Answer 5

OAuth 2.0 is an authorization framework that allows third-party applications to access a user’s resources without exposing credentials. Example: Logging in with Google.

Question 6

How does OpenID Connect (OIDC) extend OAuth 2.0?

Answer 6

OIDC adds an identity layer to OAuth 2.0, providing user authentication and user profile information in addition to authorization.

Question 7

What is MFA, and why is it important?

Answer 7

MFA requires two or more verification methods (e.g., password + one-time code) to enhance security by reducing reliance on passwords alone.

Question 8

Why is password hashing important, and what algorithms are commonly used?

Answer 8

Password hashing securely stores passwords by converting them into irreversible hashes. Common algorithms: bcrypt, Argon2, PBKDF2.

Question 9

What is the purpose of a refresh token in authentication?

Answer 9

A refresh token is used to obtain a new access token after the old one expires, maintaining a secure and seamless user experience without requiring re-authentication.

Question 10

What is Single Sign-On (SSO), and how does it work?

Answer 10

SSO allows users to log in once and access multiple related systems without re-authenticating. It uses protocols like SAML or OIDC to share authentication tokens between services.