Authentication: sessions, tokens, OAuth, OIDC, passkeys
Comes up in: Web fundamentals, Frontend system design, Recruiter screen
This concept is being written. It gets the full five steps — explanation, predict, interview angle, practice with tests, and review cards. Here is exactly what it will cover, so you can study it elsewhere in the meantime.
What it covers
- sessions (cookie) vs tokens (JWT): storage trade-offs
- refresh tokens and rotation
- OAuth 2.0 authorization code flow with PKCE (and why implicit flow is deprecated
- OAuth 2.1 draft status)
- OpenID Connect ID tokens
- passkeys/WebAuthn (public-key credentials, phishing resistance)
- MFA
- logout everywhere
Words you will know
What you will practise
- draw the auth-code + PKCE flow
- implement passkey sign-in in a demo
Interview questions this answers
- Where should you store JWTs in a browser app? Trade-offs?
- Explain the OAuth 2.0 authorization code flow with PKCE.
- What are passkeys and why are they phishing-resistant?