Skip to content

Tracks Drills Topics Technologies Tech stacks Skill areas

Tracks Drills Guides

Loading

Aporeon

Technical interview practice, from one developer to another.

Guides About Editorial standards Support Privacy Terms Refund policy

Security & Authentication

Validation, secrets, authentication integration, authorization, framework security boundaries, and common backend threats.

24 drillsPractice one at a timeOrdered pathComparison questionConcept questionArchitecture scenario

Recommended start

Authn vs Authz

Explains identity versus permission checks in API request handling and why both boundaries need server-side enforcement.

Easy~5 minStep 1 of 24

Practice this drill Choose another

Search

24 of 24 shown

1Authn vs AuthzRecommended startExplains identity versus permission checks in API request handling and why both boundaries need server-side enforcement.Comparison questionEasy~5 min.NETASP.NET CoreJWTPractice 2OAuth2PasswordBearer boundarySeparates bearer-token extraction and OpenAPI description from token validation, user lookup, and authorization.Concept questionMedium~10 minFastAPIPythonPractice 3JWT ValidationExplains JWT validation, trusted issuers, audiences, expiration, signing keys, claims, and server-side authorization boundaries.Concept questionMedium~7 min.NETASP.NET CoreJWTPractice 4Access vs RefreshExplains short-lived access tokens, refresh-token rotation, revocation, storage choices, and replay detection.Comparison questionMedium~7 min.NETASP.NET CoreJWTPractice 5Password LoginExplains password verification, hashing, throttling, generic errors, lockout, and safe login telemetry.Concept questionMedium~7 min.NETASP.NET CoreJWTPractice 6Password hashing and rehashUses a password-specific algorithm, measurable work settings, and gradual rehashing without blocking service capacity.Architecture scenarioHard~15 minPythonPractice 7Django custom user modelChooses a Django user model early and preserves swappable references without turning it into a profile dumping ground.Architecture scenarioMedium~10 minDjangoPythonPractice 8Django authentication backendsExplains backend ordering, session affinity, permission aggregation, and the difference between identity and authorization.Concept questionHard~15 minDjangoPythonPractice 9Roles vs PermissionsExplains how roles group permissions while API policies enforce specific capabilities and resource rules.Comparison questionMedium~7 min.NETASP.NET CoreJWTPractice 10FastAPI scopes and authorizationUses FastAPI Security dependencies to combine declared scopes with current application authorization.Architecture scenarioHard~15 minFastAPIPythonPractice 11IDORExplains insecure direct object reference risks and how APIs enforce ownership, tenant scope, and authorization per resource.Concept questionMedium~7 min.NETASP.NET CoreJWTPractice 12Tenant AuthzExplains trusted tenant context, membership checks, tenant-scoped queries, cache keys, and background job propagation.Concept questionHard~9 min.NETASP.NET CoreJWTPractice 13Django object permissionsClarifies Django's object-permission hook and enforces ownership or tenancy in the query and policy path.Architecture scenarioHard~15 minDjangoPythonPractice 14Stale ClaimsExplains what happens when roles or tenant membership change while access tokens still contain old claims.Concept questionHard~9 min.NETASP.NET CoreJWTPractice 15OverpostingExplains why request DTOs should expose only allowed fields and how server-owned fields stay protected.Concept questionMedium~7 min.NETASP.NET CoreJWTPractice 16FastAPI model boundariesUses separate Pydantic input and output models to prevent mass assignment and accidental data disclosure.Architecture scenarioHard~15 minFastAPIPythonPractice 17CORS BoundaryExplains what CORS controls, what it does not protect, and why APIs still need authentication and authorization.Concept questionEasy~5 min.NETASP.NET CoreJWTPractice 18CSRFExplains when CSRF matters, how cookies change browser behavior, and what mitigations fit API clients.Comparison questionMedium~7 min.NETASP.NET CoreJWTPractice 19Django sessions and CSRFConnects browser-sent session cookies to Django's CSRF token checks for unsafe requests.Architecture scenarioHard~15 minDjangoPythonPractice 20Safe ErrorsExplains safe error responses for auth failures, validation failures, server errors, and sensitive resource access.Concept questionEasy~5 min.NETASP.NET CoreJWTPractice 21Secret StorageExplains where secrets and tokens should live, what not to log, how rotation works, and how client storage changes risk.Concept questionMedium~7 min.NETASP.NET CoreAzure Key VaultPractice 22Secure tokens and comparisonUses cryptographically secure token generation and timing-resistant comparison at credential boundaries.Comparison questionMedium~10 minPythonPractice 23Webhook signature verificationVerifies provider signatures over raw bytes, enforces freshness, and makes repeated delivery idempotent.Architecture scenarioHard~15 minFastAPIPythonPractice 24Unsafe Python deserializationExplains code execution during object reconstruction and chooses data-only formats with explicit validation.Concept questionHard~15 minPythonPractice

Practice order

24 drillsOne at a time

1Authn vs AuthzUp next / Easy / ~5 min
2OAuth2PasswordBearer boundaryMedium / ~10 min
3JWT ValidationMedium / ~7 min
4Access vs RefreshMedium / ~7 min
5Password LoginMedium / ~7 min
6Password hashing and rehashHard / ~15 min
7Django custom user modelMedium / ~10 min
8Django authentication backendsHard / ~15 min

+16 more drills in this section