Choose Your Level
Pick the difficulty that matches where you are. You can come back and try a harder level later.
Implement a Secure JWT Lifecycle
Design a stateless authentication flow using Access and Refresh tokens.
Build Role-Based Access Control (RBAC)
Write Express middleware to protect routes based on user roles.
Architect an OAuth 2.0 Integration
Implement "Login with Google" securely using the Authorization Code flow.
Authentication & Role-Based Access Control (RBAC)
Securing backend systems requires robust authentication and granular access control. Recruiters test backend engineers on Role-Based Access Control (RBAC) vs Attribute-Based Access Control (ABAC), scope enforcement, JWT signature verification, and secure password hashing (Argon2 / bcrypt).
1. RBAC Permission Matrix & Policy Spec
Matrix defining roles (Admin, Manager, User), resource actions (Create, Read, Update, Delete), and permission scopes.
2. Authentication Middleware & Guard Code
Secure HTTP middleware verifying bearer tokens, enforcing role permissions, and rejecting unauthorized requests.
3. Password Hashing & Invalidation Test Log
Test suite verifying Argon2/bcrypt password hashing, salt generation, and token revocation upon password reset.
Frequently Asked Questions (Authentication & Authorization)
What is the difference between RBAC and ABAC?
RBAC grants permissions based on static user roles (e.g. Admin vs Member). ABAC evaluates dynamic attributes (e.g. user role + time of day + IP location + resource ownership).
How do you revoke stateless JWT access tokens before expiration?
Maintain a Redis blacklist of revoked JWT IDs (jti) until token expiration, or issue short-lived access tokens (15 mins) paired with revokable refresh tokens.
Why is bcrypt or Argon2 required for password storage instead of SHA-256?
Fast hash functions like SHA-256 can be brute-forced rapidly on modern GPUs. Bcrypt and Argon2 incorporate adaptive work factors (salts and memory hardness) to make brute-forcing computationally infeasible.
Explore Software Development Career Paths
Build proof of work across other topics or view full career roadmaps mapping technical skills to hiring expectations.