Pick a focused question that fits your time, stack, and interview goal.
How much time do you have?
Show one-drill sessions you can finish now.
9 results across 1 active filter
Page 1 of 1
Explains short-lived access tokens, refresh-token rotation, revocation, storage choices, and replay detection.
Explains when CSRF matters, how cookies change browser behavior, and what mitigations fit API clients.
Explains reset-token generation, hashing, expiration, generic responses, session revocation, and abuse controls.
Explains logout semantics for token-based APIs, revoking refresh tokens, device/session records, and short-lived access-token limits.
Explains what happens when roles or tenant membership change while access tokens still contain old claims.
Separates OAuth authorization from OpenID Connect authentication and explains why modern interactive clients use authorization code with PKCE.
Explains token storage, cookies, XSS, CSRF, and why browser UI never replaces server authorization.
Explains where secrets and tokens should live, what not to log, how rotation works, and how client storage changes risk.
Explains JWT validation, trusted issuers, audiences, expiration, signing keys, claims, and server-side authorization boundaries.