Compare cookies, sessions, and tokens while understanding JSON serialization and authentication boundaries.
Web fundamentals · identity
Use the strong answer as your reference, explain it aloud in your own words, then choose how soon you want to review it again.
Interview prompt
Strong answer
Authentication proves who a caller is; authorization decides what that caller may do. Cookie sessions keep server-side state referenced by a cookie, while bearer tokens carry claims that a service validates. Both require expiry, revocation strategy, secure transport, and careful storage.
Key points
Interviewer looks for
Explain the complete request flow and where identity is verified, rather than only naming JWT or sessions.
Java example
1Authorization: Bearer eyJ...
2
3// The server verifies signature, issuer, audience, expiry, and required scopes.
4// It then authorizes the requested resource.Topic interview questions
These questions are tied to this lesson. Read each question aloud, then compare your explanation with the strong answer.
Strong answer
Authentication verifies identity, while authorization decides whether that identity may perform an action on a resource. A valid login does not automatically grant access to every operation.
Strong answer
It should validate the signature and expected algorithm, issuer, audience, expiry, not-before time where used, and required scopes or roles. Decoding the payload alone provides no trust.
Strong answer
The browser stores a session identifier in a cookie and sends it on later requests; server-side state maps that identifier to the authenticated session. The cookie should use Secure, HttpOnly, and appropriate SameSite settings.
Strong answer
Store a salted, adaptive password hash using a password-specific algorithm such as Argon2id, bcrypt, or scrypt. Never store plaintext passwords or use a fast general-purpose hash such as SHA-256 alone.
Strong answer
CSRF tricks a browser into sending an authenticated request to a trusted site, while CORS controls which origins browser JavaScript may read responses from. They solve different problems and need separate policies.
How well do you know this?
Your review choice is saved locally and synced to your learner profile when signed in.