✅ Authentication & Security – Web Development Interview Questions & Answers 🔐🛡️

1️⃣ What is the difference between Authentication and Authorization?
Answer:
⦁ Authentication verifies who the user is (e.g., via username/password or biometrics), confirming identity at login.
⦁ Authorization decides what the authenticated user can access (e.g., role-based permissions like admin vs. viewer)—auth comes first, then authz for granular control in secure apps.

2️⃣ What is JWT (JSON Web Token)?
Answer:
A compact, self-contained token for stateless auth, structured as header.payload.signature (base64-encoded). The payload holds claims like user ID/roles, signed with a secret or key to prevent tampering—ideal for APIs in microservices.

3️⃣ How is JWT more secure than traditional sessions?
Answer:
JWTs are client-side, digitally signed for integrity (tamper = invalid), and stateless (no server storage, scales easily). Sessions rely on server-side cookies with IDs, vulnerable to session hijacking if not secured—JWTs shine for distributed systems but need secure storage like HttpOnly cookies.

4️⃣ What's the difference between Cookies and LocalStorage?
Answer:
⦁ Cookies: Small (4KB), auto-sent with HTTP requests, support HttpOnly/Secure flags (blocks JS access, HTTPS-only), but can be CSRF risks.
⦁ LocalStorage: Larger (5-10MB), persists across sessions, client-only access (not auto-sent), great for JWTs but exposed to XSS—use cookies for sensitive auth tokens.

5️⃣ What is CORS? Why is it important?
Answer:
CORS (Cross-Origin Resource Sharing) is a browser policy allowing/restricting cross-domain requests via headers like Access-Control-Allow-Origin. It's crucial to prevent unauthorized sites from accessing your API (e.g., stealing data), enabling safe frontend-backend separation in modern SPAs.

6️⃣ What is CSRF and how do you prevent it?
Answer:
CSRF exploits logged-in sessions by tricking users into unwanted actions on another site (e.g., fake transfer form).
Prevention: Anti-CSRF tokens (unique per session), SameSite=Strict/Lax cookies (blocks cross-site sends), double-submit cookies, and CAPTCHA—essential for state-changing POST/PUT endpoints.

7️⃣ What is XSS and how do you prevent it?
Answer:
XSS injects malicious scripts into pages viewed by others (e.g., via unsanitized user input in comments). Types: Reflected, Stored, DOM-based.
Prevention: Sanitize/escape outputs (e.g., with libraries like DOMPurify), Content Security Policy (CSP) to restrict script sources, input validation—key for user-generated content sites.

8️⃣ What is HTTPS and why is it critical?
Answer:
HTTPS adds SSL/TLS encryption to HTTP, securing data in transit with certificates for server auth and symmetric/asymmetric keys. It's critical for privacy (no MITM snooping), SEO, compliance (GDPR/PCI), and trust—browsers flag HTTP as "not secure" in 2025.

9️⃣ How do you implement password security in web apps?
Answer:
⦁ Hash with slow algos like bcrypt/Argon2 (resists brute-force), always salt uniquely per user.
⦁ Enforce policies: Min length (12+ chars), complexity, no reuse, MFA.
⦁ Rate-limit logins, monitor breaches (haveibeenpwned), and use secure storage—never plain text!

🔟 What is OAuth?
Answer:
OAuth 2.0 is an open protocol for delegated authorization, letting apps access user data from providers (e.g., Google login) via access/refresh tokens without sharing passwords. Flows like Authorization Code suit web apps—powers "Sign in with..." for seamless, secure third-party integration.

💬 Tap ❤️ if you found this useful!