Skip to content

Tracks Drills Topics Technologies Tech stacks Skill areas

Tracks Drills Topics

Loading

Aporeon interview preparation

About Privacy Terms

API Security & Auth

Auth Foundations

Authentication boundaries, password login, JWT validation, refresh tokens, session revocation, password reset, and external identity providers.

9 drillsPractice one at a timeOrdered pathComparison questionConcept question

Recommended start

Authn vs Authz

Explains identity versus permission checks in API request handling and why both boundaries need server-side enforcement.

Easy~5 minStep 1 of 9

Practice this drill Choose another

Search

9 of 9 shown

1Authn vs AuthzRecommended startExplains identity versus permission checks in API request handling and why both boundaries need server-side enforcement.Comparison questionEasy~5 min.NETASP.NET CoreJWTPractice 2

Practice order

9 drillsOne at a time

1Authn vs AuthzUp next / Easy / ~5 min
2Password LoginMedium / ~7 min
3JWT ValidationMedium / ~7 min
4

Password LoginExplains password verification, hashing, throttling, generic errors, lockout, and safe login telemetry.Concept questionMedium~7 min.NETASP.NET CoreJWT

Practice

3JWT ValidationExplains JWT validation, trusted issuers, audiences, expiration, signing keys, claims, and server-side authorization boundaries.Concept questionMedium~7 min.NETASP.NET CoreJWTPractice

4Access vs RefreshExplains short-lived access tokens, refresh-token rotation, revocation, storage choices, and replay detection.Comparison questionMedium~7 min.NETASP.NET CoreJWTPractice

5Session RevocationExplains logout semantics for token-based APIs, revoking refresh tokens, device/session records, and short-lived access-token limits.Concept questionMedium~7 min.NETASP.NET CoreJWTPractice

6Password ResetExplains reset-token generation, hashing, expiration, generic responses, session revocation, and abuse controls.Concept questionMedium~7 min.NETASP.NET CoreJWTPractice

7Identity ProviderExplains the boundary between OAuth/OIDC identity, application users, claims mapping, roles, and app-specific permissions.Concept questionMedium~7 min.NETASP.NET CoreJWTPractice

8OAuth, OIDC, and PKCESeparates OAuth authorization from OpenID Connect authentication and explains why modern interactive clients use authorization code with PKCE.Comparison questionMedium~7 min.NETASP.NET CoreOAuth2Practice

9Schemes, challenge, and forbidExplains how ASP.NET Core schemes select handlers and why authenticate, challenge, and forbid produce different security behavior.Concept questionMedium~7 min.NETASP.NET CorePractice

Access vs Refresh

Medium / ~7 min

5Session RevocationMedium / ~7 min

6Password ResetMedium / ~7 min

7Identity ProviderMedium / ~7 min

8OAuth, OIDC, and PKCEMedium / ~7 min

+1 more drills in this section

Auth Foundations - API Security & Auth | Aporeon