Backend line
Auth: JWT & OAuth
Anika shows her passport at the desk, and the valet only carries a key card.
Stops explain each step. The film plays the whole ride.
- Asking
- Waiting
- Allowed
- Refused
She seals a fingerprint
The valet writes a secret and sends only a fingerprint of it ahead.
Next stop: The window takes her there
All stops
The everyday version
A hotel desk. The passport stays there, the valet carries a key card, and the door reads the stripe.
- Anikais the Anika
The guest who shows a passport and agrees what may be fetched.
- The valetis the Client
The app that fetches the bag and never sees the passport.
- The windowis the Browser
The browser that carries Anika to the desk and back.
- Front deskis the Auth server
The only counter that sees the passport and issues the card.
- The dooris the API
The room that reads the card and does not call the desk.
Interview questions
Say the short answer first. Go deeper only if they ask.
Is the stripe on the card encrypted?
Usually no. Anyone can read the writing. The signature shows it was not changed.
A JWT is a set of claims. It can be a signed token (the usual case) or an encrypted one. Header and payload of a signed token are base64url JSON, so they are readable. Do not put a password or other secret in them. Integrity comes from the signature, checked with the algorithm you name.
“The card is encrypted, so the password can live on it.”
Why seal a note if the valet already has a secret of its own?
A public app cannot keep a secret. The note binds the ticket to the app that started.
Public clients must use PKCE. For confidential clients it is recommended, because a client secret does not prove that this token request is the one that started the redirect. The server must support PKCE, and if a challenge was sent it must require the verifier. Clients that can hash must use S256. The plain method is only for a client that cannot.
“The sealed note encrypts the ticket.”
Does the key card say who logged in?
No. The key card says what the valet may do. A separate card says who she is.
OAuth 2.0 is delegated authorization: the access token is for the resource server. OpenID Connect adds an ID token so the client can tell who authenticated. Do not treat the access token as proof of identity for your own login. The refresh token, if any, goes back only to the authorization server.
“OAuth is a login protocol.”
Why not hand the passport to the valet?
Then every leak of the valet leaks the passport. The password grant is not allowed.
The resource owner password credentials grant must not be used. It gives the password to the client, trains people to type it somewhere other than the authorization server, and does not fit a login that needs more than one step. The code flow keeps that password at the authorization server.
“The app is ours, so it can ask for the password.”
Can the desk cancel a card the valet already holds?
Not by forgetting it. The door is not calling the desk. Short expiry is the usual limit.
A signed token is checked from its own stripe, so deleting a row at the desk does not make the door forget the card before exp. Keep the lifetime short. A public client’s refresh token must be sender-constrained or rotated. Claims such as iss, sub, aud, exp, and nbf are optional in the JWT spec. When exp is present the door must not accept the card on or after that time, and when aud is present the door must be named in it.
“Delete it at the desk and every door forgets it.”
Cheat-sheet
Commands you will actually type.
GET /authorize?response_type=code&client_id=app&redirect_uri=https%3A%2F%2Fapp%2Fcb&state=xyz&code_challenge=CHALLENGE&code_challenge_method=S256Send Anika to the desk with the fingerprint, not the secret.
curl -X POST $TOKEN_URL -d grant_type=authorization_code -d code=$CODE -d code_verifier=$VERIFIER -d client_id=app -d redirect_uri=https://app/cbSpend the ticket on the back channel and reveal the secret.
curl -H "Authorization: Bearer $TOKEN" https://door.example/bagShow the key card at the door.
jwt.decode(token, key, algorithms=["RS256"])Check the signature, and name the algorithms you accept.
curl -X POST $TOKEN_URL -d grant_type=refresh_token -d refresh_token=$REFRESH -d client_id=appAsk the desk for a new card. The refresh slip is not shown at the door.