Mobile App Development Backend Integration and Data Flashcards

24 sample cards from the Backend Integration and Data deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. How does PKCE protect the OAuth 2.0 authorization code flow?

   The client generates a random code_verifier and sends its hashed code_challenge when requesting the code; at token exchange it sends the original verifier, so an attacker who steals the code cannot redeem it without the verifier.

2. What is the relationship between OpenID Connect (OIDC) and OAuth 2.0?

   OIDC is an identity layer built on top of OAuth 2.0. OAuth 2.0 handles authorization (access to resources); OIDC adds authentication (verifying who the user is) via an ID token.

3. What is an OIDC ID token and what format does it use?

   An ID token is a JWT issued by the identity provider that contains claims about the authenticated user (e.g., sub, name, email) and proves the user's identity to the client.

4. What are the three parts of a JWT and how are they separated?

   Header, Payload, and Signature, encoded in Base64URL and separated by dots: header.payload.signature.

5. Is the payload of a standard signed JWT encrypted? Explain.

   No. A standard (JWS) JWT payload is only Base64URL-encoded, not encrypted, so anyone can read it. The signature only guarantees integrity/authenticity, not confidentiality. Use JWE to encrypt.

6. What is the difference between an access token and a refresh token?

   An access token is short-lived and sent with each API request to authorize access. A refresh token is long-lived, stored securely, and used to obtain new access tokens without re-authenticating.

7. Name three commonly validated JWT claims and their meaning.

   exp (expiration time), iat (issued-at time), and iss (issuer). Others include sub (subject/user id) and aud (audience).

8. What is the difference between symmetric (HS256) and asymmetric (RS256) JWT signing?

   HS256 uses a single shared secret for both signing and verification. RS256 uses a private key to sign and a public key to verify, so verifiers never need the signing secret.

9. On mobile, what does biometric authentication actually protect, given the biometric data never leaves the device?

   It gates access to a secret or key stored in the device's secure hardware (e.g., Keychain/Keystore). The biometric match unlocks local credentials; the biometric template itself stays in the secure enclave and is never transmitted.

10. Why is biometric authentication considered a possession/inherence factor rather than a replacement for server-side auth?

    Biometrics authenticate the user locally to the device and unlock stored tokens/keys, but the server still relies on those cryptographic credentials; biometrics alone don't prove identity to a remote server.

11. What is social sign-in and what underlying protocol usually powers it?

    Social sign-in lets users authenticate using an existing account (Google, Apple, Facebook), typically implemented with OAuth 2.0 / OpenID Connect, avoiding a separate password for your app.

12. Why does Apple require 'Sign in with Apple' in certain apps offering social sign-in?

    App Store guidelines require offering Sign in with Apple as an option whenever an app exclusively uses third-party or social login services, giving users a privacy-focused alternative.

13. What three core services do 'Firebase Auth, Firestore, and Storage' provide respectively?

    Auth = user authentication/identity. Firestore = a NoSQL realtime document database. Storage = cloud object storage for user files like images and videos.

14. How is data organized in Cloud Firestore?

    As collections containing documents; documents hold key-value fields and can contain subcollections, forming a hierarchical, schemaless document model.

15. What are Firebase Security Rules used for?

    They declaratively control read/write access to Firestore, Realtime Database, and Storage on the server side based on authentication state, request data, and existing document data.

16. What is Supabase and what database engine underlies it?

    Supabase is an open-source Firebase alternative (Backend-as-a-Service) built on PostgreSQL, providing auth, realtime subscriptions, storage, and auto-generated REST/GraphQL APIs.

17. How does Appwrite differ from Supabase in database model and hosting philosophy?

    Appwrite is a self-hostable, Docker-based open-source BaaS with its own document-style database and built-in functions/storage/auth. Supabase is PostgreSQL-centric (relational, SQL) and is offered both hosted and self-hosted.

18. What are Cloud Functions and what execution model do they follow?

    Cloud Functions are serverless, event-driven functions that run backend code in response to triggers (HTTP requests, database changes, auth events) without managing servers; they auto-scale and you pay per invocation.

19. What is a 'cold start' in serverless Cloud Functions?

    The latency incurred when a function is invoked after being idle and the platform must spin up a new execution instance/container before running your code, versus a faster 'warm' reused instance.

20. What is an ORM and what core problem does it solve?

    An Object-Relational Mapper maps database tables/rows to objects/classes in code, solving the object-relational impedance mismatch so developers query and persist data using objects instead of raw SQL.

21. Why is SQLite well-suited for mobile local storage?

    SQLite is a serverless, zero-configuration, self-contained embedded relational database stored in a single file, requiring no separate process, making it ideal for on-device persistence.

22. What is Last-Write-Wins (LWW) conflict resolution and its main drawback?

    When two edits conflict during sync, the write with the latest timestamp overwrites the other. Its drawback is silent data loss of the discarded edit and sensitivity to clock skew across devices.

23. What are CRDTs and why are they useful for offline sync and conflict resolution?

    Conflict-free Replicated Data Types are data structures that can be updated independently on multiple devices and merged automatically without conflicts, guaranteeing all replicas converge to the same state regardless of update order.

24. Which secure storage mechanisms should hold tokens and secrets on iOS versus Android, and why not use plain local storage?

    iOS Keychain and Android Keystore (via encrypted storage). They store secrets in hardware-backed, encrypted form; plain local storage / SharedPreferences / UserDefaults are unencrypted and easily readable if the device is compromised.

What this deck covers

Backend Integration and Data flashcards FAQ