Question 1

Session cookies vs JWT in Node APIs — trade-offs?

Accepted Answer

Sessions: server-side revocation easy, sticky/store needed; JWT: stateless verification, harder revocation, size/claims care. Prefer httpOnly Secure SameSite cookies for browsers. Don't store sensitive data in JWT payloads. Rotate secrets/keys.

Question 2

How do you store passwords correctly?

Accepted Answer

Use strong KDFs (argon2id/bcrypt/scrypt) with per-password salts; never reversible encryption for passwords. Tune work factors. Migrate hashes on login when upgrading algorithms. Never log passwords.

Question 3

Implementing refresh token rotation — key points?

Accepted Answer

Short-lived access tokens, rotating refresh tokens, detect reuse (theft), store hashed refresh tokens server-side. Reuse detection should revoke the family. Transmit securely. Prefer opaque refresh tokens over fat JWTs for refresh.

Question 4

OAuth2 authorization code + PKCE — why for SPAs/mobile?

Accepted Answer

Prevents auth code interception without a secure client secret; PKCE binds the code to the client instance. Confidential server apps still use secrets. Understand redirect URI exact matching. Don't invent OAuth.

Question 5

Where should auth middleware run relative to rate limiting?

Accepted Answer

Rate-limit early (including unauthenticated), then authenticate, then authorize — but protect login endpoints specially. Credential stuffing needs strict limits on /login. Authenticated rate limits may be per-user. Order is an interview favorite.

Question 6

Lead: multi-service auth for a Node platform?

Accepted Answer

Central IdP/OIDC, gateway validation or sidecar JWKS cache, service-to-service mTLS or signed tokens, and consistent claim schemas. Avoid each service inventing auth. Propagate correlation IDs. Plan revocation and key rotation. Document threat model.

Authentication Node.js Interview Questions

Other Node.js interview topics