Layer 3 · Go deeper · 9 min
Go deeper
Size it, build it, then make the calls an interviewer will push you on.
Back of the envelope
Size it up
Tap through each step of the arithmetic.
How guessable is an eight-letter TV sign-in code?
What do 5-minute access tokens cost in refreshes?
Build-up · 6 steps
Follow one login through the code flow
You connect a budgeting app to your bank and sign in with your bank identity, in one pass. Watch where each value travels.
Step 1 of 6
Save three values, then redirect
On “Connect bank”, the app stores fresh random state, nonce and a PKCE code_verifier in your session, then redirects your browser to the bank’s login.
4 interview moments
You’re the candidate
The interviewer pushes on the hard parts. Pick an approach and see how it holds up.
Deep dive 1 of 4
Interviewer
“Your single-page app shows users their bank transactions. Which OAuth setup do you choose?”
Any script on the page, from an XSS bug or a poisoned npm package, runs alongside your code.
Your move. Pick an approach:
Deep dive 2 of 4
Interviewer
“Your web app’s backend is a confidential client with a secret. Do you still need PKCE?”
Your move. Pick an approach:
Deep dive 3 of 4
Interviewer
“Your Swiggy-style food app adds “Sign in with Provider X”. How does your backend decide who just logged in?”
Your move. Pick an approach:
Deep dive 4 of 4
Interviewer
“Your bank API serves 30,000 requests a second. How does it check each access token?”
Your move. Pick an approach:
Build-up · 5 steps
Why an access token isn’t a login
A Swiggy-style food app adds “Sign in with Provider X”. Watch a malicious quiz app become you, then watch the ID token stop it.
Step 1 of 5
Log in with an access token
The food app gets an access token from X and sends it to its backend, which calls X’s profile API and logs in whoever it names.