| 1 | What is the OAuth 2.0 Client Credentials flow, and when is it used instead of the Authorization Code flow? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Intermediate |
| 2 | What is the purpose of the 'scope' parameter in OAuth 2.0, and how does it implement the principle of least privilege? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Intermediate |
| 3 | How does the OAuth 2.0 Authorization Code flow work, and why is it preferred over the deprecated Implicit flow for web applications? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Advanced |
| 4 | How do you integrate external identity providers (Google, Microsoft Entra ID, Facebook) using OAuth/OpenID Connect in ASP.NET Core? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Advanced |
| 5 | How do JWTs, OAuth, and Passport.js fit together in a typical Node.js authentication architecture? Node.js › Authentication & Authorization (JWT, OAuth, Passport) | Node.js | Authentication & Authorization (JWT, OAuth, Passport) | Intermediate |
| 6 | How would you implement 'Sign in with GitHub' using Passport's OAuth strategy in an Express application? Node.js › Authentication & Authorization (JWT, OAuth, Passport) | Node.js | Authentication & Authorization (JWT, OAuth, Passport) | Intermediate |
| 7 | What is PKCE (Proof Key for Code Exchange), and why is it now recommended for OAuth flows even in traditional server-side Node.js applications? Node.js › Authentication & Authorization (JWT, OAuth, Passport) | Node.js | Authentication & Authorization (JWT, OAuth, Passport) | Advanced |
| 8 | How does the OAuth 2.0 Authorization Code flow work, and what role does Node.js typically play as the client or the resource server? Node.js › Authentication & Authorization | Node.js | Authentication & Authorization | Advanced |
| 9 | How do you implement OAuth/OpenID Connect login in MAUI? .NET MAUI › Security & Authentication | .NET MAUI | Security & Authentication | Intermediate |
| 10 | How do you implement OAuth/OpenID Connect login in MAUI? .NET MAUI › Security & Authentication | .NET MAUI | Security & Authentication | Intermediate |
| 11 | How do external identity provider integrations (like Google or Microsoft Entra ID) work using OAuth/OpenID Connect authentication handlers? ASP.NET Core › Authentication | ASP.NET Core | Authentication | Advanced |
| 12 | What is ASP.NET Core Identity, and what does it provide out of the box? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Intermediate |
| 13 | How do you implement role-based authorization using the [Authorize(Roles = "...")] attribute? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Intermediate |
| 14 | How do refresh tokens work alongside short-lived access tokens, and why is this pattern used? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Intermediate |
| 15 | What are JWT claims, and how do you add custom claims when issuing a token? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Advanced |
| 16 | How do you implement policy-based authorization for more complex, custom access rules beyond simple roles? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Advanced |
| 17 | How does token revocation work with stateless JWTs, given they can't simply be 'deleted' server-side once issued? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Advanced |
| 18 | How does token validation work under the hood when the JwtBearer middleware receives a request, and what checks does it perform? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Advanced |
| 19 | What is the difference between authentication and authorization in ASP.NET Core? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Beginner |
| 20 | How does JWT (JSON Web Token) authentication work at a high level in ASP.NET Core? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Intermediate |
| 21 | What are the security risks of storing JWTs in browser localStorage versus HttpOnly cookies? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Intermediate |
| 22 | How do you validate a JWT's claims (issuer, audience, expiration) beyond just verifying its cryptographic signature? Node.js › Authentication & Authorization (JWT, OAuth, Passport) | Node.js | Authentication & Authorization (JWT, OAuth, Passport) | Intermediate |
| 23 | How does ASP.NET Core support multiple authentication schemes simultaneously (e.g., cookies for a web UI and JWT for an API in the same application)? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Advanced |
| 24 | How do authentication and authorization work together in a .NET application, and how would you implement both role-based and policy-based access control? .NET › Authentication & Authorization (Identity, JWT, OAuth) | .NET | Authentication & Authorization (Identity, JWT, OAuth) | Advanced |
| 25 | What is token introspection, and when is it needed instead of simply verifying a JWT's signature locally? Node.js › Authentication & Authorization (JWT, OAuth, Passport) | Node.js | Authentication & Authorization (JWT, OAuth, Passport) | Advanced |
| 26 | What is the difference between authentication and authorization in a Node.js application? Node.js › Authentication & Authorization | Node.js | Authentication & Authorization | Beginner |
| 27 | Why does the order in which middleware is registered matter so much in ASP.NET Core? .NET › ASP.NET Core Middleware & Request Pipeline | .NET | ASP.NET Core Middleware & Request Pipeline | Intermediate |
| 28 | How do you conditionally apply middleware only to certain requests using UseWhen or MapWhen? .NET › ASP.NET Core Middleware & Request Pipeline | .NET | ASP.NET Core Middleware & Request Pipeline | Intermediate |
| 29 | How does dependency injection work in Blazor components, and what's the difference between @inject and constructor injection? .NET › Blazor (Server & WebAssembly) | .NET | Blazor (Server & WebAssembly) | Intermediate |
| 30 | What is the difference between absolute expiration and sliding expiration when configuring a cache entry? .NET › Caching (In-Memory, Distributed & Redis) | .NET | Caching (In-Memory, Distributed & Redis) | Intermediate |
| 31 | What are the risks of caching sensitive or user-specific data, and how do you avoid cache poisoning across users? .NET › Caching (In-Memory, Distributed & Redis) | .NET | Caching (In-Memory, Distributed & Redis) | Intermediate |
| 32 | How do you configure a CORS policy in ASP.NET Core to allow requests from specific origins? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Intermediate |
| 33 | What does AllowCredentials() do in a CORS policy, and why can't it be combined with a wildcard origin? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Intermediate |
| 34 | Why must UseCors be positioned after UseRouting but before UseAuthorization in the ASP.NET Core middleware pipeline? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Intermediate |
| 35 | What is the difference between CORS and CSRF (Cross-Site Request Forgery), and how does CORS relate to (but not fully prevent) CSRF? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Intermediate |
| 36 | How do you register a service using a factory delegate instead of a simple type mapping, when construction requires custom logic? .NET › Dependency Injection | .NET | Dependency Injection | Intermediate |
| 37 | Why is it recommended to run a containerized .NET application as a non-root user, and how do you configure this in a Dockerfile? .NET › Docker & Containerization | .NET | Docker & Containerization | Intermediate |
| 38 | What is middleware in ASP.NET Core, and how does the order in which it's registered affect request handling? .NET › ASP.NET Core Middleware & Request Pipeline | .NET | ASP.NET Core Middleware & Request Pipeline | Intermediate |
| 39 | How does session-based authentication work in a Node.js/Express application, and what does the session store need to handle? Node.js › Authentication & Authorization | Node.js | Authentication & Authorization | Intermediate |
| 40 | What is a JSON Web Token (JWT), and what are its three parts? Node.js › Authentication & Authorization | Node.js | Authentication & Authorization | Intermediate |
| 41 | What is Passport.js, and how do its 'strategies' provide a consistent authentication abstraction across different methods? Node.js › Authentication & Authorization | Node.js | Authentication & Authorization | Intermediate |
| 42 | What does the node:crypto module provide, and what's the difference between hashing and encryption? Node.js › Core Node.js Modules | Node.js | Core Node.js Modules | Intermediate |
| 43 | What is the difference between sending SMS via a provider's REST API (like Twilio) versus using SMTP-based email in terms of a Node.js integration? Node.js › Email & Notifications | Node.js | Email & Notifications | Intermediate |
| 44 | What is an API Gateway, and what role does it play in front of a collection of Node.js microservices? Node.js › Microservices Architecture with Node.js | Node.js | Microservices Architecture with Node.js | Intermediate |
| 45 | How does UseRouting and endpoint routing (via MapControllers, MapGet, etc.) fit into the middleware pipeline conceptually? .NET › ASP.NET Core Middleware & Request Pipeline | .NET | ASP.NET Core Middleware & Request Pipeline | Advanced |
| 46 | What is the recommended standard order for common middleware in a typical ASP.NET Core Web API pipeline, and why? .NET › ASP.NET Core Middleware & Request Pipeline | .NET | ASP.NET Core Middleware & Request Pipeline | Advanced |
| 47 | Why is it dangerous to capture and store an HttpContext reference in a singleton-scoped service, and what should you use instead? .NET › ASP.NET Core Middleware & Request Pipeline | .NET | ASP.NET Core Middleware & Request Pipeline | Advanced |
| 48 | How do you apply different CORS policies to different endpoints or controllers within the same application? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Advanced |
| 49 | What security risks does an overly permissive CORS policy (like AllowAnyOrigin with credentials attempted, or reflecting the Origin header) introduce? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Advanced |
| 50 | How does CORS behave differently for requests made from a mobile app or server-to-server call compared to a browser-based web app? .NET › CORS & Cross-Origin Resource Sharing | .NET | CORS & Cross-Origin Resource Sharing | Advanced |
| 51 | What information should be excluded from error responses in production to avoid leaking sensitive implementation details? .NET › Global Exception Handling & Middleware | .NET | Global Exception Handling & Middleware | Advanced |
| 52 | How does gRPC support interceptors for cross-cutting concerns like authentication, logging, and retries, similar to middleware in a REST pipeline? .NET › gRPC Services | .NET | gRPC Services | Advanced |
| 53 | How do you handle authentication for gRPC calls, and how does it differ from typical REST API authentication patterns? .NET › gRPC Services | .NET | gRPC Services | Advanced |
| 54 | How do you implement JWT refresh token rotation in a Node.js API, and why is it more secure than a single long-lived token? Node.js › Authentication & Authorization | Node.js | Authentication & Authorization | Advanced |
| 55 | What is horizontal scaling for a Node.js application, and what specific architectural requirement does it impose? Node.js › Cloud & DevOps | Node.js | Cloud & DevOps | Advanced |
| 56 | How would you implement authentication and authorization in a GraphQL API in Node.js, given there's typically only a single HTTP endpoint? Node.js › GraphQL | Node.js | GraphQL | Advanced |
| 57 | How would you implement authentication and authorization in a GraphQL API, given all requests typically go through a single endpoint? Node.js › GraphQL with Node.js | Node.js | GraphQL with Node.js | Advanced |