IntermediateTECHNICAL
How do you typically implement authentication and authorization in a backend service using tokens such as JWT, including secure storage, token expiry, refresh strategies, and protecting sensitive endpoints?
Backend Developer
General

Sample Answer

On my last project, we migrated from cookie sessions to a JWT-based auth flow for a mobile-heavy app with ~2M MAUs. We issued short-lived access tokens (15 minutes) and longer-lived refresh tokens (7–14 days), both signed with rotating keys managed in KMS. Access tokens never hit storage; refresh tokens were stored hashed in a DB/Redis so we could revoke individually. The flow was: login → issue access + refresh → clients send access token in the Authorization header (no JWTs in localStorage) → when it expires, hit a dedicated refresh endpoint guarded by rate limiting and device fingerprint checks. We implemented role- and permission-based authorization at the API gateway and in service-level middleware, so sensitive endpoints required both scopes and contextual checks (e.g., resource ownership). We also added a token blacklist for high-risk events (password change, device loss) and saw unauthorized access incidents drop by ~80% after the rollout.

Keywords

Short-lived access tokens with longer-lived refresh tokens and key rotationSecure handling: Authorization headers, hashed refresh tokens, revocationLayered authorization: roles, scopes, and resource ownership checksHardening: rate limits, blacklists, and monitoring for suspicious activity