Loading…
0+ curated questions with the same answer shape every time: quick recap, deep dive, pitfalls, and follow-ups. Coverage includes .
Authentication and authorization interview questions cover the most security-sensitive part of any Rails application. This module covers Devise (model concerns, Warden hooks, OmniAuth integration, devise-jwt for token auth), JWT structure (header.payload.signature), JWT validation and the algorithm confusion attack (always specify algorithm explicitly — never trust the alg header), Doorkeeper for OAuth 2.0 authorization server, OAuth 2.0 flows (authorization code vs client credentials vs implicit), refresh tokens and rotation, Pundit policy objects and policy_scope for row-level access control, CanCanCan Ability class and can?/cannot?, role-based vs attribute-based access control, API key authentication with database-stored hashed keys, and session vs token trade-offs for Rails APIs.
Full catalog
Topics are ordered for learning. Within each topic, rows are numbered 1–0 globally so you always know where you are. Collapse topics if you want a lighter view — use Expand all when you need the full list again.
Numbers 1–0 follow the order we recommend — click any row to open the full answer, or use the sticky Next link at the bottom of each page to go Q1 → Q0.