Pick a focused question that fits your time, stack, and interview goal.
How much time do you have?
Show one-drill sessions you can finish now.
25 results across 1 active filter
Page 1 of 2
Explains rate-limit identity, endpoint cost, login and suggestion throttles, Redis counters, user experience, and observability.
Explains why sensitive admin actions need authorization, reason capture, before/after context, and tamper-resistant audit records.
Explains API keys, client credentials, managed identity, mTLS, scopes, rotation, and per-client observability.
Separates identity establishment from permission decisions and applies ASP.NET Core schemes, policies, tenant boundaries, ownership checks, and correct challenge or forbid behavior.
Explains trusted tenant context, membership checks, tenant-scoped queries, cache keys, and background job propagation.
Explains short-lived access tokens, refresh-token rotation, revocation, storage choices, and replay detection.
Explains when CSRF matters, how cookies change browser behavior, and what mitigations fit API clients.
Explains how roles group permissions while API policies enforce specific capabilities and resource rules.
Debugs ASP.NET Core authentication challenges and authorization forbids across schemes, token validation, policies, claims, tenants, and resource checks.
Explains reset-token generation, hashing, expiration, generic responses, session revocation, and abuse controls.
Explains password verification, hashing, throttling, generic errors, lockout, and safe login telemetry.
Explains what CORS controls, what it does not protect, and why APIs still need authentication and authorization.
Explains logout semantics for token-based APIs, revoking refresh tokens, device/session records, and short-lived access-token limits.
Explains what happens when roles or tenant membership change while access tokens still contain old claims.
Explains how to diagnose 401/403 spikes across token validation, identity provider issues, clock skew, deployment changes, and abuse.
Explains insecure direct object reference risks and how APIs enforce ownership, tenant scope, and authorization per resource.
Explains why request DTOs should expose only allowed fields and how server-owned fields stay protected.
Explains where secrets and tokens should live, what not to log, how rotation works, and how client storage changes risk.
Explains safe error responses for auth failures, validation failures, server errors, and sensitive resource access.
Separates identity issuance, untrusted client behavior, API authorization, tenant isolation, resource checks, and token-handling responsibilities.
Explains identity versus permission checks in API request handling and why both boundaries need server-side enforcement.
Explains the boundary between OAuth/OIDC identity, application users, claims mapping, roles, and app-specific permissions.
Explains policy-based authorization, requirements, handlers, claims, capabilities, and resource-aware checks.
Explains HTTPS, HSTS, secure cookies, HttpOnly, SameSite, no-store, and practical API/browser security hardening.