intermediate

Identity & API Security

OAuth2/OIDC delegated authorization and authentication, JWT validation, and the OWASP API Top 10 — where identity is proven and where per-object access is enforced.

security-identity-api

Practice: 12 questions →

Sections

Contents

Detailed explanation

Identity & API Security

Modern services rarely check a password themselves — they delegate. OAuth2 lets an app act on your behalf without your credentials, OIDC layers on the answer to who signed in, and the API is where the server decides what each caller may touch. Two questions run through everything here: authentication (who are you) and authorization (what may you do). Confuse them, trust a token you didn't verify, or let a client-supplied id decide access, and the whole boundary collapses.

The recurring lesson is that the server is the only authority. Tokens are the currency of trust, but a token is only as good as its verification: pinned algorithm, checked issuer and audience, live lifetime. And at the API layer, authorization is enforced per object, on the server — never delegated to a hidden button, a gateway filter alone, or the id the caller happened to send.

Topic map

OAuth2 & OIDC — delegated authorization versus authentication, the authorization-code + PKCE flow, state and exact-match redirect_uri, id_token versus access_token audiences, JWT validation, refresh-token rotation and revocation.
API security — the OWASP API Top 10 shape: BOLA and function-level authorization, excessive data exposure, mass assignment, rate limiting, API credentials, schema validation, versioning, GraphQL, and gateway-versus-service enforcement.

Interview relevance: these two layers are where identity and API rounds live — expect "walk me through the auth-code flow and why PKCE", "how do you validate a JWT", and "why is BOLA number one on the OWASP API list". A candidate who keeps authentication and authorization distinct and always puts the check on the server stands out immediately.

Why it matters

Almost every modern service delegates login and then decides, per request, what the caller may touch. If you blur authentication and authorization, trust a token you never verified, or let a client-supplied id decide access, the entire boundary collapses — and these are exactly the failures interviewers probe. This topic gives you the precise model of who is proven where and how access is enforced.

Identity & API Security

Topic map

OAuth2 & OIDC — delegated authorization versus authentication, the authorization-code + PKCE flow, state and exact-match redirect_uri, id_token versus access_token audiences, JWT validation, refresh-token rotation and revocation.

API security — the OWASP API Top 10 shape: BOLA and function-level authorization, excessive data exposure, mass assignment, rate limiting, API credentials, schema validation, versioning, GraphQL, and gateway-versus-service enforcement.