Cookies and sessions, JWT structure, OAuth 2.0 grant types, OpenID Connect, CSRF, SameSite and password storage basics.
40 cards · basic cards · AI-written, checked twice. Edit anything.
- What is an HTTP cookie?
Show answer
A small piece of data stored on the client browser and sent with every request to the same domain.- What does the HttpOnly attribute do on a cookie?
Show answer
Prevents JavaScript from accessing the cookie; it is only sent with HTTP requests.- What does the Secure attribute do on a cookie?
Show answer
The cookie is only sent over HTTPS, not plain HTTP.- What is a session in web authentication?
Show answer
Server-side storage of user data associated with a unique session ID.- How do sessions and cookies work together?
Show answer
The server creates a session and stores its ID in a cookie on the client; the client sends the cookie with each request to retrieve session data.- What is a session ID?
Show answer
A unique identifier that the server uses to look up and retrieve session data associated with a specific user.- What is JWT?
Show answer
JSON Web Token: a compact, self-contained token that encodes claims about a user in JSON format.- What are the three parts of a JWT, in order?
Show answer
Header (token type and algorithm), Payload (claims), Signature (cryptographic verification).- What does a JWT header contain?
Show answer
The token type (usually JWT) and the signing algorithm (such as HS256 or RS256).- What does a JWT payload contain?
Show answer
Claims: statements about the subject, encoded as JSON key-value pairs.- What does a JWT signature do?
Show answer
It cryptographically verifies that the token has not been tampered with and confirms the issuer.- What is a claim in JWT?
Show answer
A statement about the subject, such as the user's identity, role, permissions, or expiration time.- What does the sub claim represent in JWT?
Show answer
The subject: the principal entity (usually the user) that the token is about.- What does the aud claim represent in JWT?
Show answer
The audience: the intended recipient or service that should accept the token.- What does the exp claim represent in JWT?
Show answer
The expiration time: a timestamp after which the token is no longer valid.
FlashKeepers