Backend Development Authentication, Authorization and Security Syllabus

Why is the OAuth 2.0 Implicit flow now discouraged?

It returns the access token directly in the URL fragment, exposing it to browser history, referrer leakage, and interception, with no client authentication. The Authorization Code flow with PKCE is now recommended instead.

What is the OAuth 2.0 Client Credentials grant used for?

Machine-to-machine authentication where no user is involved. The client authenticates with its own credentials to obtain an access token for its own resources (e.g., a backend service calling an API).

Fundamentally, what is OAuth 2.0 designed for, and what is it NOT designed for?

OAuth 2.0 is an authorization framework for delegating access to resources (permissions). It is NOT an authentication protocol for identifying users; using access tokens alone to prove identity is insecure. OpenID Connect adds authentication on top.

What does OpenID Connect (OIDC) add on top of OAuth 2.0?

An identity layer. It introduces the ID token (a JWT with authenticated user identity claims), a standardized /userinfo endpoint, and the 'openid' scope, turning OAuth's authorization into authentication.

What is the difference between an OIDC ID token and an OAuth access token?

The ID token proves who the user is (identity claims) and is intended for the client. The access token grants permission to call resource APIs and is intended for the resource server. They serve authentication vs. authorization respectively.

Define Single Sign-On (SSO).

An authentication scheme where a user logs in once with a single set of credentials and gains access to multiple independent applications/services without re-authenticating to each.

What does SAML stand for, what format does it use, and what is the core artifact it exchanges?

Security Assertion Markup Language. It is XML-based and exchanges signed SAML assertions containing authentication and attribute statements between an Identity Provider (IdP) and a Service Provider (SP).

Compare SAML and OIDC for SSO.

SAML is XML-based, mature, and common in enterprise/web-SSO. OIDC is JSON/JWT-based, built on OAuth 2.0, and better suited to modern mobile and single-page applications and APIs. Both federate identity via an IdP.

In SAML, what are the roles of the Identity Provider (IdP) and Service Provider (SP)?

The IdP authenticates the user and issues assertions. The SP is the application the user wants to access; it trusts and consumes the IdP's assertions to grant access without authenticating the user itself.

Define Role-Based Access Control (RBAC).

An access-control model where permissions are assigned to roles, and users are assigned roles. Access is determined by the user's role(s) rather than by individual user identity, simplifying administration.

Define Attribute-Based Access Control (ABAC) and how it differs from RBAC.

ABAC grants access based on policies evaluating attributes of the subject, resource, action, and environment (e.g., department, time, location). Unlike RBAC's fixed roles, ABAC is more dynamic and fine-grained, expressing context-aware rules.

Give an example ABAC policy that RBAC alone could not easily express.

"Allow access only if user.department == resource.department AND time is between 9am-5pm AND user.clearance >= resource.classification." This combines multiple contextual attributes rather than a single static role.

What is an Access Control List (ACL)?

A list attached to a resource (object) that specifies, per subject (user or group), which operations (read, write, execute) are permitted or denied. It is object-centric authorization.

Contrast the object-centric ACL model with the capability-based model.

An ACL is attached to the object and lists who may access it (answers "who can access this file?"). A capability is held by the subject as an unforgeable token/reference granting rights (answers "what can this user access?").

In access control, distinguish the PEP, PDP, and PAP.

PEP (Policy Enforcement Point) intercepts requests and enforces the decision. PDP (Policy Decision Point) evaluates policies and returns permit/deny. PAP (Policy Administration Point) is where policies are authored and managed. Often a PIP (Information Point) supplies attributes.

What is the principle of least privilege?

Every user, process, or system should be granted only the minimum permissions necessary to perform its function, and no more, reducing the attack surface and blast radius of a compromise.

What is the difference between a default-deny (whitelist) and default-allow (blacklist) authorization policy, and which is safer?

Default-deny blocks everything except explicitly permitted actions; default-allow permits everything except explicitly forbidden actions. Default-deny is safer because forgotten cases fail closed (denied) rather than being unintentionally exposed.

What is the OWASP Top 10?

A regularly updated awareness document listing the ten most critical web application security risks, published by the Open Worldwide Application Security Project to guide developers on the most common and impactful vulnerabilities.

Name five categories from the OWASP Top 10 (2021).

Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration (others: Vulnerable and Outdated Components, Identification and Authentication Failures, Software and Data Integrity Failures, Security Logging and Monitoring Failures, Server-Side Request Forgery).

What category ranked #1 in the OWASP Top 10 2021?

Broken Access Control—flaws that let users act outside their intended permissions (e.g., accessing other users' data, privilege escalation, IDOR).

What is an injection attack, and what is the root cause?

An attack where untrusted input is interpreted as part of a command or query (SQL, OS, LDAP, NoSQL). The root cause is mixing untrusted data with code/commands without proper separation, so the data is executed as instructions.

What is the primary defense against SQL injection?

Parameterized queries / prepared statements, which bind user input strictly as data separate from the SQL code so it can never be interpreted as commands. Supplement with input validation, least-privilege DB accounts, and ORMs.

What is Cross-Site Scripting (XSS)?

An injection vulnerability where an attacker injects malicious scripts into web content that executes in other users' browsers, enabling session/cookie theft, defacement, or actions on the victim's behalf.

Distinguish stored, reflected, and DOM-based XSS.

Stored: malicious script is persisted on the server (e.g., in a comment) and served to victims. Reflected: script is embedded in a request and reflected back in the immediate response (e.g., via a link). DOM-based: the vulnerability is in client-side JavaScript manipulating the DOM with untrusted data, never reaching the server.

What is the primary defense against XSS?

Context-aware output encoding/escaping of untrusted data when rendering into HTML, attributes, JS, or URLs, plus input validation, using safe frameworks/APIs (avoiding innerHTML), and a Content Security Policy as defense in depth.

What is Cross-Site Request Forgery (CSRF)?

An attack that tricks an authenticated user's browser into sending a forged state-changing request to a site where they are logged in, exploiting automatically-sent credentials (cookies) to perform actions without consent.

Name the main defenses against CSRF.

Anti-CSRF synchronizer tokens (unpredictable per-session/per-request token validated server-side), the SameSite cookie attribute, double-submit cookies, and verifying Origin/Referer headers for state-changing requests.

Why does the SameSite=Lax or Strict cookie attribute help mitigate CSRF?

It instructs the browser not to send the cookie on cross-site requests (Strict) or only on top-level navigations (Lax), so a forged request from an attacker's site arrives without the victim's authentication cookie.

What does the Content-Security-Policy (CSP) header do, and which attack does it primarily mitigate?

CSP restricts which sources the browser may load scripts, styles, images, etc. from (e.g., script-src 'self'), primarily mitigating XSS and data-injection by blocking inline/unauthorized scripts.

What does the HTTP Strict-Transport-Security (HSTS) header enforce?

It forces browsers to use HTTPS-only connections to the site for a specified max-age, preventing protocol-downgrade and SSL-stripping man-in-the-middle attacks and blocking use of the plain HTTP version.

Compare symmetric and asymmetric encryption in terms of keys, speed, and typical use.

Symmetric uses one shared secret key for both encryption and decryption—fast, ideal for bulk data (e.g., AES). Asymmetric uses a public/private key pair (encrypt with one, decrypt with the other)—slower, used for key exchange, digital signatures, and identity (e.g., RSA, ECC). TLS combines both: asymmetric to exchange a symmetric session key.