Backend interview prep

Start

OAuth 2.0 Interview Questions and Answers

Top 10 OAuth 2.0 interview questions with Mermaid diagrams, production scenarios, authorization flows, and enterprise best practices.

OAuth 2.0 - Interview Questions & Answers

OAuth 2.0 is the industry-standard authorization framework used by Google, Microsoft, GitHub, Facebook, Amazon, and thousands of enterprise applications. It allows users to grant limited access to their resources without sharing their passwords.

OAuth 2.0 is an authorization framework, not an authentication protocol.

Q1. What is OAuth 2.0?

Answer

OAuth 2.0 is an authorization framework that allows third-party applications to access protected resources on behalf of a user without exposing the user's credentials.

Example

Instead of sharing your Google password with an application, you authorize Google to issue an access token.

OAuth 2.0 Flow

flowchart LR
A[User] --> B[Client Application] --> C[Authorization Server] --> D[Access Token] --> E[Resource Server] --> F[Protected Resource]

Benefits

  • No password sharing
  • Delegated authorization
  • Secure API access
  • Token-based communication

Q2. What are the main components of OAuth 2.0?

Answer

OAuth 2.0 consists of four major roles.

Component Responsibility
Resource Owner User
Client Application requesting access
Authorization Server Issues access tokens
Resource Server Hosts protected APIs

OAuth Components

flowchart TD
A[Resource Owner] --> B[Client]

B --> C[Authorization Server]

C --> D[Access Token]

D --> E[Resource Server]

Interview Tip

The Authorization Server and Resource Server may be separate services.

Q3. How does OAuth 2.0 work?

Answer

Typical OAuth 2.0 flow:

  1. User clicks Login.
  2. User is redirected to Authorization Server.
  3. User authenticates.
  4. User grants consent.
  5. Authorization Server issues Authorization Code.
  6. Client exchanges the code for an Access Token.
  7. Access Token is used to access APIs.

Authorization Code Flow

sequenceDiagram
participant User
participant Client
participant AuthServer
participant ResourceServer
User->>Client: Login
Client->>AuthServer: Authorization Request
AuthServer->>User: Login & Consent
User->>AuthServer: Approve
AuthServer->>Client: Authorization Code
Client->>AuthServer: Exchange Code
AuthServer->>Client: Access Token
Client->>ResourceServer: API Request + Token
ResourceServer-->>Client: Protected Resource

Q4. What is an Access Token?

Answer

An Access Token is a credential issued by the Authorization Server.

It is used by the client to access protected resources.

Token Usage

flowchart LR
A[Authorization Server] --> B[Access Token] --> C[Client] --> D[Resource Server]

Characteristics

  • Short-lived
  • Limited permissions
  • Contains scopes
  • Can expire

Interview Tip

Access Tokens should always be transmitted over HTTPS.

Q5. What is a Refresh Token?

Answer

A Refresh Token is used to obtain a new Access Token after the existing Access Token expires.

Refresh Flow

flowchart TD
A[Access Token Expired] --> B[Refresh Token] --> C[Authorization Server] --> D[New Access Token] --> E[Continue API Calls]

Benefits

  • Better security
  • Short-lived access tokens
  • Improved user experience

Refresh Tokens should be securely stored and rotated when appropriate.

Q6. What are OAuth 2.0 Grant Types?

Answer

OAuth 2.0 defines several grant types.

Grant Type Usage
Authorization Code Web & Mobile Apps
Client Credentials Machine-to-Machine
Device Authorization Smart TVs & IoT
Refresh Token Renew Access Token

Grant Types

flowchart TD
A[OAuth2]

A --> B[Authorization Code]

A --> C[Client Credentials]

A --> D[Device Code]

A --> E[Refresh Token]

Enterprise Recommendation

The Authorization Code Flow with PKCE is recommended for public clients.

Q7. What is the difference between OAuth 2.0 and JWT?

Answer

OAuth 2.0 and JWT solve different problems.

OAuth2 JWT
Authorization Framework Token Format
Defines authorization flow Carries claims
Issues tokens Represents token data
Supports multiple token types Self-contained token

Relationship

flowchart LR
A[OAuth2 Authorization Server] --> B[JWT Access Token] --> C[Spring Boot API]

Interview Tip

OAuth 2.0 may issue JWT tokens, opaque tokens, or other token formats.

Q8. What is the difference between OAuth 2.0 and OpenID Connect (OIDC)?

Answer

OAuth 2.0 provides authorization.

OpenID Connect adds authentication on top of OAuth 2.0.

OAuth2 OpenID Connect
Authorization Authentication + Authorization
Access Token Access Token + ID Token
Resource Access User Identity

Comparison

flowchart TD
A[OAuth2] --> B[Authorization]

C[OpenID Connect] --> D[Authentication] --> E[Authorization]

Interview Tip

Use OpenID Connect when the application needs to identify the user.

Q9. What are the OAuth 2.0 security best practices?

Answer

Follow these best practices:

  • Always use HTTPS.
  • Use Authorization Code Flow with PKCE.
  • Keep Access Tokens short-lived.
  • Rotate Refresh Tokens.
  • Validate token signatures.
  • Restrict scopes.
  • Store tokens securely.
  • Protect client secrets.
  • Monitor token usage.
  • Revoke compromised tokens.

Secure OAuth Flow

flowchart TD
A[Client] --> B[HTTPS] --> C[Authorization Server] --> D[Access Token] --> E[Resource Server] --> F[Protected API]

Answer

Enterprise applications centralize authentication and authorization using OAuth 2.0.

Enterprise Architecture

flowchart TD
A[User] --> B[Browser / Mobile App] --> C[Authorization Server] --> D[Access Token] --> E[API Gateway] --> F[Spring Boot Microservices] --> G[Database]

End-to-End OAuth Flow

flowchart LR
A[Client Application] --> B[Authorization Server] --> C[JWT Access Token] --> D[API Gateway] --> E[Spring Security] --> F[Protected REST API]

Senior Interview Tip

Modern enterprise applications typically implement:

  • OAuth 2.0 for authorization
  • OpenID Connect (OIDC) for authentication
  • JWT Access Tokens
  • PKCE for public clients
  • Short-lived Access Tokens
  • Refresh Token Rotation
  • API Gateway Token Validation
  • Spring Security Resource Server
  • HTTPS for all communication
  • Centralized Identity Providers such as Keycloak, Okta, Auth0, Microsoft Entra ID, or Google Identity

Remember:

  • OAuth 2.0 answers: "Can this application access this resource?"
  • OpenID Connect answers: "Who is the user?"

Quick Revision

  • OAuth 2.0 is an authorization framework.
  • It allows delegated access without sharing passwords.
  • The four roles are Resource Owner, Client, Authorization Server, and Resource Server.
  • Access Tokens authorize API access.
  • Refresh Tokens obtain new Access Tokens.
  • Authorization Code Flow is the most common grant type.
  • Use PKCE for public clients.
  • OAuth 2.0 is different from JWT.
  • OpenID Connect extends OAuth 2.0 with authentication.
  • Enterprise applications combine OAuth 2.0, JWT, Spring Security, and API Gateways.