Skip to content

Tracks Drills Topics Technologies Tech stacks Skill areas

Tracks Drills Topics

Loading

Aporeon

Technical interview practice, from one developer to another.

About Support Privacy Terms Refund policy

Security & Authentication

Validation, secrets, authentication integration, authorization, framework security boundaries, and common backend threats.

24 drillsPractice one at a timeOrdered pathComparison questionConcept questionArchitecture scenario

Recommended start

Authn vs Authz

Explains identity versus permission checks in API request handling and why both boundaries need server-side enforcement.

Easy~5 minStep 1 of 24

Practice this drill Choose another

Search

24 of 24 shown

1Authn vs AuthzRecommended startExplains identity versus permission checks in API request handling and why both boundaries need server-side enforcement.Comparison questionEasy~5 min.NETASP.NET CoreJWTPractice 2

Practice order

24 drillsOne at a time

1Authn vs AuthzUp next / Easy / ~5 min
2OAuth2PasswordBearer boundaryMedium / ~10 min
3JWT ValidationMedium / ~7 min
4

OAuth2PasswordBearer boundarySeparates bearer-token extraction and OpenAPI description from token validation, user lookup, and authorization.Concept questionMedium~10 minFastAPIPython

Practice

3JWT ValidationExplains JWT validation, trusted issuers, audiences, expiration, signing keys, claims, and server-side authorization boundaries.Concept questionMedium~7 min.NETASP.NET CoreJWTPractice

4Access vs RefreshExplains short-lived access tokens, refresh-token rotation, revocation, storage choices, and replay detection.Comparison questionMedium~7 min.NETASP.NET CoreJWTPractice

5Password LoginExplains password verification, hashing, throttling, generic errors, lockout, and safe login telemetry.Concept questionMedium~7 min.NETASP.NET CoreJWTPractice

6Password hashing and rehashUses a password-specific algorithm, measurable work settings, and gradual rehashing without blocking service capacity.Architecture scenarioHard~15 minPythonPractice

7Django custom user modelChooses a Django user model early and preserves swappable references without turning it into a profile dumping ground.Architecture scenarioMedium~10 minDjangoPythonPractice

8Django authentication backendsExplains backend ordering, session affinity, permission aggregation, and the difference between identity and authorization.Concept questionHard~15 minDjangoPythonPractice

9Roles vs PermissionsExplains how roles group permissions while API policies enforce specific capabilities and resource rules.Comparison questionMedium~7 min.NETASP.NET CoreJWTPractice

10FastAPI scopes and authorizationUses FastAPI Security dependencies to combine declared scopes with current application authorization.Architecture scenarioHard~15 minFastAPIPythonPractice

11IDORExplains insecure direct object reference risks and how APIs enforce ownership, tenant scope, and authorization per resource.Concept questionMedium~7 min.NETASP.NET CoreJWTPractice

12Tenant AuthzExplains trusted tenant context, membership checks, tenant-scoped queries, cache keys, and background job propagation.Concept questionHard~9 min.NETASP.NET CoreJWTPractice

13Django object permissionsClarifies Django's object-permission hook and enforces ownership or tenancy in the query and policy path.Architecture scenarioHard~15 minDjangoPythonPractice

14Stale ClaimsExplains what happens when roles or tenant membership change while access tokens still contain old claims.Concept questionHard~9 min.NETASP.NET CoreJWTPractice

15OverpostingExplains why request DTOs should expose only allowed fields and how server-owned fields stay protected.Concept questionMedium~7 min.NETASP.NET CoreJWTPractice

16FastAPI model boundariesUses separate Pydantic input and output models to prevent mass assignment and accidental data disclosure.Architecture scenarioHard~15 minFastAPIPythonPractice

17CORS BoundaryExplains what CORS controls, what it does not protect, and why APIs still need authentication and authorization.Concept questionEasy~5 min.NETASP.NET CoreJWTPractice

18CSRFExplains when CSRF matters, how cookies change browser behavior, and what mitigations fit API clients.Comparison questionMedium~7 min.NETASP.NET CoreJWTPractice

19Django sessions and CSRFConnects browser-sent session cookies to Django's CSRF token checks for unsafe requests.Architecture scenarioHard~15 minDjangoPythonPractice

20Safe ErrorsExplains safe error responses for auth failures, validation failures, server errors, and sensitive resource access.Concept questionEasy~5 min.NETASP.NET CoreJWTPractice

21Secret StorageExplains where secrets and tokens should live, what not to log, how rotation works, and how client storage changes risk.Concept questionMedium~7 min.NETASP.NET CoreAzure Key VaultPractice

22Secure tokens and comparisonUses cryptographically secure token generation and timing-resistant comparison at credential boundaries.Comparison questionMedium~10 minPythonPractice

23Webhook signature verificationVerifies provider signatures over raw bytes, enforces freshness, and makes repeated delivery idempotent.Architecture scenarioHard~15 minFastAPIPythonPractice

24Unsafe Python deserializationExplains code execution during object reconstruction and chooses data-only formats with explicit validation.Concept questionHard~15 minPythonPractice

Access vs Refresh

Medium / ~7 min

5Password LoginMedium / ~7 min

6Password hashing and rehashHard / ~15 min

7Django custom user modelMedium / ~10 min

8Django authentication backendsHard / ~15 min

+16 more drills in this section

Security & Authentication - Python Backend | Aporeon