Skip to content

Tracks Drills Topics Technologies Tech stacks Skill areas

Tracks Drills Topics

Loading

Aporeon

Technical interview practice, from one developer to another.

About Privacy Terms

API Security & Auth

Auth Foundations

Authentication boundaries, password login, JWT validation, refresh tokens, session revocation, password reset, and external identity providers.

9 drillsPractice one at a timeOrdered pathComparison questionConcept question

Recommended start

Authn vs Authz

Explains identity versus permission checks in API request handling and why both boundaries need server-side enforcement.

Easy~5 minStep 1 of 9

Practice this drill Choose another

Search

9 of 9 shown

1Authn vs AuthzRecommended startExplains identity versus permission checks in API request handling and why both boundaries need server-side enforcement.Comparison questionEasy~5 min.NETASP.NET CoreJWTPractice 2Password LoginExplains password verification, hashing, throttling, generic errors, lockout, and safe login telemetry.Concept questionMedium~7 min.NETASP.NET CoreJWTPractice 3JWT ValidationExplains JWT validation, trusted issuers, audiences, expiration, signing keys, claims, and server-side authorization boundaries.Concept questionMedium~7 min.NETASP.NET CoreJWTPractice 4Access vs RefreshExplains short-lived access tokens, refresh-token rotation, revocation, storage choices, and replay detection.Comparison questionMedium~7 min.NETASP.NET CoreJWTPractice 5Session RevocationExplains logout semantics for token-based APIs, revoking refresh tokens, device/session records, and short-lived access-token limits.Concept questionMedium~7 min.NETASP.NET CoreJWTPractice 6Password ResetExplains reset-token generation, hashing, expiration, generic responses, session revocation, and abuse controls.Concept questionMedium~7 min.NETASP.NET CoreJWTPractice 7Identity ProviderExplains the boundary between OAuth/OIDC identity, application users, claims mapping, roles, and app-specific permissions.Concept questionMedium~7 min.NETASP.NET CoreJWTPractice 8OAuth, OIDC, and PKCESeparates OAuth authorization from OpenID Connect authentication and explains why modern interactive clients use authorization code with PKCE.Comparison questionMedium~7 min.NETASP.NET CoreOAuth2Practice 9Schemes, challenge, and forbidExplains how ASP.NET Core schemes select handlers and why authenticate, challenge, and forbid produce different security behavior.Concept questionMedium~7 min.NETASP.NET CorePractice

Practice order

9 drillsOne at a time

1Authn vs AuthzUp next / Easy / ~5 min
2Password LoginMedium / ~7 min
3JWT ValidationMedium / ~7 min
4Access vs RefreshMedium / ~7 min
5Session RevocationMedium / ~7 min
6Password ResetMedium / ~7 min
7Identity ProviderMedium / ~7 min
8OAuth, OIDC, and PKCEMedium / ~7 min

+1 more drills in this section