Backend · core
Auth Systems
OAuth2, JWT, session, RBAC.
Mental model
Authentication proves who you are; authorization decides what you may do. JWTs are stateless and fast but hard to revoke; sessions are revocable but need a store. Pick per the revocation requirement.
How to study Auth Systems
Begin by restating the mental model in your own words, then connect it to a concrete system you have built or operated. Name the mechanism, the constraint it addresses, and the trade-off it introduces. Use OAuth 2.0, Introduction to JSON Web Tokens to check details, but close the source before writing your explanation. Retrieval is the learning step; rereading is only preparation.
Next, compare Auth Systems with API Keys. Ask what changes in correctness, latency, resource use, operability, and failure recovery. Complete JWT revocation tradeoff and preserve the command, input, output, and one failed attempt as evidence. Finish by explaining the idea without jargon to someone who has not studied the track.
Proof of understanding
- Explain the mechanism from first principles and identify the state it reads or changes.
- Give one situation where the concept is the right choice and one where it is not.
- Predict a realistic failure mode before running the drill, then compare the prediction with evidence.
- Connect the result to a roadmap or build artifact instead of treating the concept as isolated trivia.
Where it matters
OAuth2/OIDC, every multi-user product.
Common mistakes
- Confusing authentication with authorization
- Long-lived JWTs with no revocation strategy
- Trusting client-supplied roles
Learn from primary sources
- OAuth 2.0 (doc)
- Introduction to JSON Web Tokens (doc)
Practice and explain it back
JWT revocation tradeoff
User logs out. Session store vs JWT blacklist vs short TTL+refresh — pick one for banking app, justify.
Expected evidence: Short-lived JWT + refresh rotation or server session for instant revoke.
Open the interactive drill →Review prompts
- What is the core tradeoff between JWTs and server sessions?
Build evidence
Reusable API key system
Issue, hash, scope, and rotate API keys for machine clients.
- Keys stored only as hashes
- Prefix for log-searchability
- Scopes and a revocation path