IntermediateTECHNICAL
Explain how you would design and implement an authentication and authorization flow for a RESTful API used by both a web frontend and a mobile app. Be specific about token format, storage, expiration, and how you’d handle refresh tokens.
Backend Developer
General

Sample Answer

I like a short-lived access token and longer-lived refresh token setup. For a recent project with ~300k MAUs, we used JWT access tokens (15 minutes) and opaque refresh tokens (7–14 days) stored server-side in Redis. For web, the access token went in memory and the refresh token in an HttpOnly, Secure, SameSite cookie to minimize XSS/CSRF risk. For mobile, both tokens were stored in the platform’s secure storage (Keychain/Keystore). Every request sent the Bearer access token; when it expired, the client hit a dedicated /auth/refresh endpoint with the refresh token. On the backend, we rotated refresh tokens on each use, tracked device IDs, and could revoke individual sessions instantly. That setup cut “mysterious logout” complaints by about 60% versus our previous single-JWT approach and made it straightforward to implement fine-grained role/permission checks at the service layer.

Keywords

Access JWT (short-lived) plus opaque refresh token (longer-lived) approachDifferent storage strategies for web (HttpOnly cookies) vs mobile (secure storage)Secure refresh flow with rotation, device tracking, and revocationRole/permission checks enforced in backend services
Related Questions

Based on your hydrology and irrigation engineering background, explain how you would estimate the irrigation water requirement for a kharif crop in a semi-arid region of Gujarat. Walk me through each step: from reference evapotranspiration estimation, crop coefficient selection, effective rainfall calculation, to arriving at canal discharge for a given command area.

IntermediateTECHNICAL

In your civil engineering studies, what specific design coursework or project work did you complete related to irrigation channels or canals (e.g., design of lined/unlined canals, distributaries, minors)? Describe one such design in detail, including how you determined discharge, permissible velocity, section dimensions, and lining choice for Gujarat-type soil and climate conditions.

IntermediateTECHNICAL

Walk me through a recent multi-channel digital marketing campaign you managed end-to-end. How did you set objectives, choose channels, allocate budget, and measure success?

IntermediateBEHAVIORAL

In your resume you note improving or optimizing [a process, KPI, or metric]. What specific baseline metrics did you start from, what steps did you personally take, and how did you verify that the improvement was due to your changes rather than external factors?

IntermediatePROBLEM_SOLVING

On your resume you mention working on a cross-functional project (e.g., involving multiple teams or stakeholders). Describe a situation from that project where priorities conflicted—how did you navigate the trade-offs and what was the final outcome?

IntermediateSITUATIONAL