IntermediateTECHNICAL
Describe how you would implement secure user authentication and authorization in a backend service, including password storage, session or token management, and common security pitfalls to avoid.
Backend Developer
General

Sample Answer

On my last project we rebuilt auth for a SaaS product with ~80k monthly active users. I started with password handling: bcrypt/Argon2 with a strong work factor, unique per-user salts, and enforcing strong password policies and rate limiting at both IP and account level. Passwords never leave HTTPS, and we centralized auth behind a dedicated service. For sessions, we moved from sticky server sessions to stateless JWTs with short-lived access tokens (15 minutes) and refresh tokens stored httpOnly, secure, sameSite cookies. We included jti claims and stored them in Redis to support token revocation and logout across devices. For authorization, we implemented role- and permission-based checks at the API layer using a policy engine instead of sprinkling checks through the code. Along the way we closed several common gaps: we added CSRF protection on cookie-based flows, used parameterized queries everywhere, and added strict validation and output encoding. A pen test afterward found zero high-severity auth issues and reduced account-takeover incidents by ~60%.

Keywords

Use strong hashing (bcrypt/Argon2), salts, and rate limiting for password storagePrefer short-lived JWT access tokens with refresh tokens in secure httpOnly cookiesCentralize authorization with roles/permissions and a policy layerAddress common pitfalls: CSRF, token revocation, brute force, SQL injection
Related Questions

In your civil engineering studies, what specific design coursework or project work did you complete related to irrigation channels or canals (e.g., design of lined/unlined canals, distributaries, minors)? Describe one such design in detail, including how you determined discharge, permissible velocity, section dimensions, and lining choice for Gujarat-type soil and climate conditions.

IntermediateTECHNICAL

Based on your hydrology and irrigation engineering background, explain how you would estimate the irrigation water requirement for a kharif crop in a semi-arid region of Gujarat. Walk me through each step: from reference evapotranspiration estimation, crop coefficient selection, effective rainfall calculation, to arriving at canal discharge for a given command area.

IntermediateTECHNICAL

On your resume you mention working on a cross-functional project (e.g., involving multiple teams or stakeholders). Describe a situation from that project where priorities conflicted—how did you navigate the trade-offs and what was the final outcome?

IntermediateSITUATIONAL

Walk me through a recent multi-channel digital marketing campaign you managed end-to-end. How did you set objectives, choose channels, allocate budget, and measure success?

IntermediateBEHAVIORAL

In your resume you note improving or optimizing [a process, KPI, or metric]. What specific baseline metrics did you start from, what steps did you personally take, and how did you verify that the improvement was due to your changes rather than external factors?

IntermediatePROBLEM_SOLVING