Implement secure token flows and protect APIs against common web security mistakes.
Security · tokens and threats
Use the strong answer as your reference, explain it aloud in your own words, then choose how soon you want to review it again.
Interview prompt
Strong answer
OAuth2 is a delegation framework: an authorization server issues access tokens, a client obtains them (Authorization Code with PKCE for user-facing apps, Client Credentials for service-to-service), and a resource server validates them before authorizing a request. A JWT is one token format; it is trustworthy only after signature, issuer, audience, expiry, and scopes are verified. API security also covers transport, rate limits, input validation, secrets handling, and the OWASP API risks such as broken object-level authorization.
Key points
Interviewer looks for
Pick the right grant for a scenario, explain exactly what the resource server checks, and discuss revocation, token storage in browsers, and how you would rotate signing keys.
Java example
1# application.yml (resource server)
2spring.security.oauth2.resourceserver.jwt:
3 issuer-uri: https://auth.example.com/realms/shop
4 audiences: orders-api
5
6@Bean
7JwtAuthenticationConverter jwtAuthConverter() {
8 var scopes = new JwtGrantedAuthoritiesConverter();
9 scopes.setAuthorityPrefix("SCOPE_");
10 var converter = new JwtAuthenticationConverter();
11 converter.setJwtGrantedAuthoritiesConverter(scopes);
12 return converter;
13}
14
15@PreAuthorize("hasAuthority('SCOPE_orders:write')")
16@PostMapping("/api/orders")
17OrderResponse create(@Valid @RequestBody CreateOrder cmd, @AuthenticationPrincipal Jwt jwt) {
18 return service.create(cmd, jwt.getSubject());
19}Topic interview questions
These questions are tied to this lesson. Read each question aloud, then compare your explanation with the strong answer.
Strong answer
Authorization Code with PKCE. The app cannot keep a client secret, so PKCE binds the authorization code to a one-time verifier. The implicit grant and password grant are deprecated because they expose tokens or credentials.
Strong answer
The signature using the expected algorithm and a key from the issuer's JWKS, the issuer, the audience intended for this API, expiry and not-before times, and the scopes or claims required for the endpoint. Only then does it build an Authentication and run authorization.
Strong answer
Keep access tokens short-lived, revoke or rotate the refresh token server-side, and for high-risk cases maintain a denylist of token ids or use opaque tokens with introspection. Each option trades statelessness against immediate revocation.
Strong answer
OAuth2 lets a client obtain an access token to call an API on a user's behalf. OpenID Connect is an identity layer on top that adds an ID token, standard user claims, and a userinfo endpoint so the client can log the user in.
Strong answer
It is when an API trusts an object id from the request without checking that the caller may access that object, for example GET /orders/42 returning someone else's order. Prevent it with ownership checks on every lookup, owner-scoped queries, and tests that try cross-tenant access.
How well do you know this?
Your review choice is saved locally and synced to your learner profile when signed in.