Stop 20 · Interview PreparationTechnical · 6/8

Authentication & security

Part of the Full Stack Developer Roadmap

In short

Auth questions come up in almost every full stack interview, because auth touches every layer. Be ready to trace a login from the form to the cookie to the database and back.

Interview-level fluency in full-stack auth flows and common vulnerabilities — a frequent topic since auth touches every layer of the stack.

The purple blob receives a wristband from a friendly guard at a flower-decorated hall entrance.

Think of it like this

The wedding hall wristband

At the gate, you show your invite once and get a wristband. Inside, nobody checks your invite again, only the band. It can't be peeled off and reused, and it stops working after the night. That's a session cookie.

Watch it happen

"Walk me through your login flow"

Verify

Session

Each request

Logout

1/5The form posts email and password over HTTPS. The login route is rate limited per IP and account.

The big ideas

What you need to know

Hash, never encrypt

Store passwords with bcrypt or argon2 so even a leaked database doesn't reveal them.

Cookie flags do real work

httpOnly blocks JavaScript (XSS theft), Secure needs HTTPS, SameSite limits cross-site sends (CSRF).

Sessions vs JWTs

Sessions are easy to revoke. JWTs avoid a lookup but are hard to cancel early. Know both trade-offs.

Know the big attacks

XSS, CSRF, SQL injection, broken access control. For each, one line on how your stack prevents it.

See it in code

Walk through the code

1app.post("/api/login", loginLimiter, async (req, res) => {2  const { email, password } = LoginSchema.parse(req.body);3  const user = await db.user.findUnique({ where: { email } });4  const ok = user && (await bcrypt.compare(password, user.passwordHash));5  if (!ok) return res.status(401).json({ error: { code: "INVALID_CREDENTIALS" } });6 7  const sessionId = crypto.randomBytes(32).toString("hex");8  await db.session.create({ data: { id: sessionId, userId: user.id, expiresAt: addDays(new Date(), 7) } });9  res.cookie("sid", sessionId, {10    httpOnly: true,  // JavaScript can't read it, so XSS can't steal it11    secure: true,    // only sent over HTTPS12    sameSite: "lax", // not sent on most cross-site requests, which blunts CSRF13    maxAge: 7 * 24 * 60 * 60 * 1000,14  });15  res.json({ id: user.id, name: user.name });16});

1/4A rate limiter on login slows down password guessing.

A server-side session login in Express. Interviewers love asking why each cookie flag is there.

Save yourself the pain

Common mistakes

Oops

Storing a JWT in localStorage and calling it secure.

Do this instead

Any XSS can read localStorage. Prefer httpOnly cookies, and explain the trade-off if you do use tokens.

Oops

Checking only that a user is logged in before returning /api/orders/:id.

Do this instead

Also check the order belongs to them. Broken access control is the most common real bug.

Your mission

Trace your own login

~35 min

Quick check

Why mark the session cookie httpOnly?

Go deeper

1Be ready to diagram a complete login flow from frontend form to backend token issuance.
2Know how you'd securely store and verify passwords, and where tokens should live on the frontend.
3Prepare a real security consideration you addressed in a full-stack project.

More technical at this stop