Back-end Web Developement APIs Syllabus

Contrast stateful (session-based) authentication with stateless (token-based) authentication.

Session-based: server stores session state and gives the client a session ID (usually in a cookie); server must look it up each request. Token-based (e.g., JWT): the token itself carries the claims and is verified by signature, so the server keeps no per-session state.

In the OAuth 2.0 framework, name the four main roles.

Resource Owner (the user), Client (the app requesting access), Authorization Server (issues tokens), and Resource Server (hosts the protected resources).

What is the difference between OAuth 2.0 and OpenID Connect (OIDC)?

OAuth 2.0 is an authorization framework (delegating access via access tokens). OIDC is an authentication layer built on top of OAuth 2.0 that adds an ID token to verify user identity.

How is a Bearer token sent in an HTTP request?

In the Authorization header: Authorization: Bearer <token>.

Compare RBAC and ABAC authorization models.

RBAC (Role-Based Access Control) grants permissions based on a user's assigned roles. ABAC (Attribute-Based Access Control) grants access by evaluating policies over attributes of the user, resource, action, and environment/context.

Why should passwords be stored hashed with a salt rather than encrypted or in plaintext?

Hashing is one-way, so the original password cannot be recovered if the store leaks. A unique salt per password prevents identical passwords from sharing a hash and defeats precomputed rainbow-table attacks. Use slow adaptive functions like bcrypt, scrypt, or Argon2.

What is the primary difference between an API key and a JWT for authentication?

An API key is a static opaque identifier (typically identifying an application/project, requiring a server lookup) whereas a JWT is a signed, self-contained token carrying claims about the user that can be validated without a database lookup and can expire.

In GraphQL, what is a schema and what language defines it?

The schema is the contract describing all types, fields, and operations the API exposes. It is written in SDL (Schema Definition Language) and is strongly typed.

Name the three special/root operation types in a GraphQL schema.

Query (read), Mutation (write/modify), and Subscription (real-time streamed updates).

In GraphQL SDL, what does the '!' symbol mean on a field type?

It marks the field as non-nullable (required). For example, name: String! must always return a value, and [String!]! is a non-null list of non-null strings.

List the built-in scalar types in GraphQL.

Int, Float, String, Boolean, and ID.

What is the difference between a GraphQL 'type' (object type) and an 'input' type?

An object type describes data returned by the server and can be used in query responses. An input type is used only to pass structured arguments into fields/mutations and cannot contain fields that return object types with resolvers.

What is an enum type in a GraphQL schema?

A scalar restricted to a fixed set of allowed named values, e.g. enum Role { ADMIN USER GUEST }, which the server validates against.

In GraphQL, what is an interface type used for?

An interface is an abstract type defining a set of fields that multiple object types must implement, enabling polymorphic fields that can return any implementing type.

What is a resolver in GraphQL?

A function that produces the value for a single field in a schema. When a query executes, GraphQL calls the resolver for each requested field to fetch or compute its data.

What are the four standard arguments passed to a GraphQL resolver function?

parent (the result of the parent/previous resolver), args (the field's arguments), context (shared per-request data like auth/db), and info (AST/metadata about the execution state).

What is the 'context' argument in a resolver typically used for?

To share per-request state across all resolvers, such as the authenticated user, database connections, data loaders, and request headers.

What is the N+1 problem in GraphQL resolvers, and a common solution?

When resolving a list of N items, a naive per-item resolver triggers 1 query for the list plus N additional queries for related data. It is solved by batching and caching requests, e.g. using DataLoader to coalesce them into a single query.

What happens if you do not define a resolver for a field in GraphQL?

GraphQL uses a default resolver: it returns the property of the parent object with the same name as the field (or calls it if it is a function), returning null if absent.

What is the key difference between a GraphQL query and a mutation?

A query fetches (reads) data and top-level query fields run in parallel. A mutation modifies (writes) data and top-level mutation fields execute serially, one after another, to avoid race conditions.

How are variables passed to a GraphQL query instead of hardcoding arguments?

By declaring them in the operation signature with a $ prefix and type, e.g. query GetUser($id: ID!) { user(id: $id) { name } }, then supplying a separate JSON variables object with the values.

What is a fragment in GraphQL?

A reusable named set of fields on a type that can be spread into multiple queries/mutations to avoid repetition, e.g. fragment UserFields on User { id name email }.

What is an alias in a GraphQL query and why is it needed?

An alias renames a field's result key, letting you request the same field multiple times with different arguments in one query, e.g. hero: character(id:1) { name } villain: character(id:2) { name }.

State one major advantage GraphQL offers over REST regarding data fetching.

Clients request exactly the fields they need in a single request, eliminating over-fetching and under-fetching (and the multiple round-trips REST often requires).

What is the fundamental limitation of plain HTTP request/response for real-time communication?

HTTP is client-initiated and half-duplex per exchange: the server cannot push data to the client on its own; the client must poll or re-request, causing latency and overhead.

Compare short polling, long polling, SSE, and WebSockets for real-time updates.

Short polling: client repeatedly requests at intervals (high overhead). Long polling: server holds the request open until data is ready. SSE (Server-Sent Events): one-way server-to-client stream over HTTP. WebSockets: full-duplex, persistent, bidirectional connection.

What is the WebSocket protocol and how does a connection start?

A protocol providing a persistent, full-duplex TCP channel between client and server. It begins with an HTTP Upgrade handshake (Connection: Upgrade, Upgrade: websocket); once accepted, communication switches to the ws:// or wss:// protocol.

What is Socket.IO and how does it relate to WebSockets?

Socket.IO is a library for real-time bidirectional event-based communication. It uses WebSockets when available but adds features like automatic reconnection, fallbacks (e.g., HTTP long-polling), rooms, namespaces, and acknowledgements — so it is not a pure WebSocket implementation.

In Socket.IO, what are the emit and on methods used for?

socket.emit(event, data) sends/publishes a named custom event with a payload to the other side; socket.on(event, callback) registers a listener that handles incoming events of that name.

In Socket.IO, what is a 'room' and how is it used?

A room is a server-side channel that sockets can join or leave (socket.join('roomName')); the server can then broadcast to all sockets in that room with io.to('roomName').emit(...), enabling targeted group messaging like chat channels.

In Socket.IO, distinguish socket.emit, socket.broadcast.emit, and io.emit.

socket.emit sends only to that one connected client; socket.broadcast.emit sends to all connected clients except the sender; io.emit sends to every connected client including the sender.