OAuth2, OIDC & JWT Flows

Authentication vs authorization

• AuthN — who are you? (login, token, cert)
• AuthZ — what may you do? (roles, scopes, resource checks)

Fail AuthN → 401. Fail AuthZ → 403. Don't conflate.

OAuth2 grant types (know 3)

Grant	Use	Interview note
Authorization code + PKCE	User login (SPA, mobile)	Default for public clients
Client credentials	Service-to-service	Machine identity, no user
Refresh token	Long-lived sessions	Rotate, revoke, bind to client

Avoid: implicit flow (deprecated), resource owner password (legacy only).

OIDC adds identity

OAuth2 = authorization. OpenID Connect adds id_token with user claims (sub, email).

Login button → OIDC provider (Google, Okta, Auth0).

JWT structure

header.payload.signature

Validate on every request:

1. Signature (issuer's JWKS)
2. exp not passed
3. aud matches your API
4. iss trusted

Never trust payload without signature verify.

JWT pitfalls (senior favorites)

Pitfall	Attack
alg: none	Strip signature check
Confusion RS256/HS256	Use public key as HMAC secret
Long exp	Stolen token valid for days
Sensitive data in payload	JWT is base64, not encrypted

Prefer opaque tokens + introspection for high-security; JWT for stateless scale.

Sessions vs tokens

	Session cookie	Bearer JWT
Storage	Server-side session store	Client holds token
Revoke	Instant	Hard until expiry
Scale	Sticky session or shared store	Stateless verification

HttpOnly, Secure, SameSite cookies for session IDs (Web Security topic).

Where validation happens

• Gateway — signature, expiry, coarse scopes
• Service — resource-level AuthZ (always)

Cross-reference: Microservices → API Gateway for edge termination; Communication → REST for 401/403 semantics.