Skip to content
Interview prep

Access and security

Who the user is and what they may do: from web security basics to OAuth 2.0 and OpenID Connect, JWT, corporate sign-in through Active Directory, Kerberos and ADFS, and designing authorization.

Before this category: Hosting and the pipeline, Web API.

Web security basicsAuthentication vs authorization, OWASP Top 10, XSS and CORS, injection and password storage, HTTPS and TLS.
OAuth 2.0 and OpenID ConnectRoles and flows, authorization code with PKCE, tokens and their lifetime, OIDC sign-in in ASP.NET Core, SPAs and BFF.
JWT and API protectionToken structure and signature, validation in ASP.NET Core, common vulnerabilities, service-to-service tokens.
AD, Kerberos and ADFSNTLM and Kerberos, Negotiate in ASP.NET Core, double hop and delegation, ADFS and federation, AD groups.
AuthorizationRoles, policies and claims, resource-based authorization, ABAC and ReBAC, designing an access management system.