How do you typically implement authentication and authorization in your services (e.g., sessions vs. JWT, role‑based access, permissions)? What security pitfalls do you watch out for in that setup?

Question

VirtualInterview.AI · Accepted Answer

In most backend services I’ve built, I separate authentication and authorization pretty cleanly. For authN, I usually rely on an identity provider (Cognito/Auth0/Keycloak or an internal service) and use short‑lived JWT access tokens plus long‑lived refresh tokens. For web apps, I prefer HTTP‑only secure cookies with SameSite=strict, even if the cookie just stores a reference to a session in Redis.

For authZ, I start simple with role‑based access (admin, support, customer) but usually evolve to permission/claim‑based checks at the service layer. For example, our billing service checked claims like `can_refund` and `account_id`, not just “role=admin”. That let us safely delegate limited powers to support agents and cut production escalations by about 30%.

Pitfall‑wise, I watch for: storing too much data in JWTs, not rotating signing keys, missing token invalidation on logout/role changes, CSRF on cookie‑based flows, and over‑trusting client‑side checks. I also enforce TLS everywhere and use rate limiting on login and token endpoints.

Sample Answer

Keywords