Authentication, Authorization, and Session Management
Core concepts
Separate authentication (who you are) from authorization (what you may do) and from session management (how state persists). Know password storage with adaptive hashing (bcrypt, scrypt, Argon2) and per-user salts; MFA categories (something you know/have/are) and why push-based MFA is vulnerable to fatigue attacks; and phishing-resistant factors such as FIDO2/WebAuthn. Understand OAuth 2.0 and OIDC roles (resource owner, client, authorization server, resource server) and the authorization-code flow with PKCE for public clients. Know SAML assertions and the risks of weak signature validation.
Authorization and sessions
Know RBAC vs ABAC, and that broken access control (IDOR, missing function-level checks) is enforced server-side on every request, never in the UI. For sessions: cookies with Secure, HttpOnly, SameSite, rotation on login and privilege change, idle and absolute timeouts, and server-side invalidation on logout. Understand CSRF tokens and SameSite as complementary defenses, and why JWT alg: none and unverified claims are classic failures.
Traps
Questions offer client-side checks as authorization; assume JWT is encrypted (it is signed, not confidential); confuse authentication with authorization in OAuth (OIDC adds identity); or treat "remember me" tokens as low risk when they are long-lived credentials.
Rule of thumb
Every request re-checks authorization against the resource owner; every session change rotates the identifier.
Worked example
A user changes /invoice/1042 to /invoice/1043 and sees another customer's data. The fix is a server-side ownership check on each request, not a hidden link or a UI filter.