QA
Beginner LevelAuthentication & Authorization

Compare JWT Token Authentication versus Stateful Sessions, and explain OAuth 2.0 PKCE flow.

❓ Interview Prompt: Detail security trade-offs of storing JWTs in httpOnly cookies vs localStorage, token revocation strategies, and OAuth 2.0 PKCE for SPAs.

1. Stateful Sessions vs Stateless JWTs:

•
Stateful Sessions: Stored in server memory or Redis with a session ID sent via 'httpOnly' cookie. Easy to revoke instantly on the server, but requires a shared session store across microservices.
•
Stateless JWTs: Self-contained signed tokens containing claims. Great for decoupled microservices, but invalidating them before natural expiration requires token blacklists or short TTLs.

Storage Security Trade-Offs:

Storing tokens in 'localStorage' makes them accessible to client-side JavaScript, leaving them vulnerable to Cross-Site Scripting (XSS). The gold standard pattern is storing access tokens in memory and long-lived refresh tokens in 'httpOnly, Secure, SameSite=Strict' cookies.

OAuth 2.0 PKCE Flow:

Proof Key for Code Exchange (PKCE) replaces client secrets for public clients (SPAs, mobile apps). It generates a dynamic cryptographically random code verifier and code challenge per authorization attempt, preventing authorization code interception attacks.

Code Implementation Example

typescript
// Express.js secure httpOnly cookie configuration for refresh tokens
res.cookie('refreshToken', token, {
  httpOnly: true,     // Blocks JavaScript document.cookie XSS access
  secure: true,       // Enforces HTTPS transmission only
  sameSite: 'strict', // Prevents Cross-Site Request Forgery (CSRF)
  maxAge: 7 * 24 * 60 * 60 * 1000 // 7 Days TTL
});
💡Express.js secure httpOnly cookie configuration for refresh token storage.
🎯 Interview Key Takeaway

Store refresh tokens in httpOnly SameSite=Strict cookies to protect against XSS and CSRF attacks.

#Authentication#JWT#OAuth#Security#Beginner
Back to all Authentication & Authorization Questions→

More Authentication & Authorization Interview Questions

Beginner LevelAuthentication & Authorization

What is the fundamental difference between Authentication (AuthN) and Authorization (AuthZ)?

Beginner LevelAuthentication & Authorization

Why should passwords never be stored in plain text and how do bcrypt and Argon2id work?