Question 1

OAuth 2.0 vs OpenID Connect, what's the difference?

Accepted Answer

OAuth 2.0 = authorization (grants access to resources). OpenID Connect = authentication (proves who you are). Use OAuth for 'access your Google Drive' and OIDC for 'sign in with your Google account'. OIDC is built on top of OAuth 2.0, adding an ID token with user info. Modern practice: always use OIDC when you need both auth and access.

Question 2

Authorization Code flow vs Implicit flow, which should I use?

Accepted Answer

Authorization Code: secure, use for web apps and mobile apps (with PKCE). Tokens never exposed in browser. Implicit: deprecated, use only for legacy SPAs without a backend. Always add PKCE to Authorization Code flow for public clients (SPAs, mobile).

Question 3

What is PKCE and why is it essential?

Accepted Answer

PKCE (Proof Key for Code Exchange) prevents authorization code interception attacks. Generate a random code_verifier (43-128 chars), hash it to code_challenge, send in auth request, verify on token exchange. Mandatory for SPAs and mobile apps. Use in Authorization Code flow. Without PKCE: attacker intercepts auth code and trades it for tokens.

Question 4

How do I securely store and refresh tokens?

Accepted Answer

Access tokens: store in httpOnly cookies (not localStorage, vulnerable to XSS). Refresh tokens: httpOnly cookie, rotate on each use, short-lived (15 min access token, 7-30 day refresh). Implement token revocation on logout. Server-side validation: never trust tokens without verifying signature and expiry.

Question 5

JWT validation, what must I check?

Accepted Answer

Verify signature using the provider's public key (JWKS endpoint). Check expiry (exp claim). Validate issuer (iss). Check audience (aud) matches your app. Never skip signature validation. Use jwt.io to decode and inspect tokens during development.

Question 6

How do I implement social login (Google, GitHub)?

Accepted Answer

Register your app with the provider (get Client ID and Secret). Redirect user to their authorization endpoint. User grants permission and gets redirected back with an authorization code. Exchange code for access token. Fetch user info from provider's API. Create or update local user. Return session token to client.

Question 7

What's the difference between access tokens and refresh tokens?

Accepted Answer

Access token: short-lived (15 min), grants API access, included in every request. Refresh token: long-lived (days/weeks), used to get new access token, stored securely, never sent in API requests. Refresh flow: client sends refresh token, server validates and returns new access token. If refresh token compromised, attacker gets limited access until it expires.

प्रदेश	ज्युनियर	मध्यम	सीनियर
USA	$105k	$145k	$190k
UK	£65k	£90k	£130k
EU	€70k	€95k	€140k
CANADA	C$110k	C$155k	C$210k

OAuth 2.0

OAuth 2.0 म्हणजे काय

📋 सुरू करण्यापूर्वी

💰 प्रदेशानुसार पगार

🎓 प्रमाणपत्रे

⚖ यांच्याशी तुलना करा

❓ FAQ

हे कौशल्य तुमच्यासाठी योग्य आहे का, याची खात्री नाही?

तुमचा आदर्श करिअर मार्ग शोधा