Backend interview prep

Start

OAuth2 Basics Interview Questions and Answers

Learn OAuth2 fundamentals with 10 interview questions, Mermaid diagrams, authorization flows, Spring Security examples, and enterprise best practices.

OAuth2 Basics - Interview Questions & Answers

OAuth 2.0 is the industry-standard authorization framework used to allow applications to access protected resources on behalf of users without sharing their passwords.

OAuth2 is used by almost every major platform including Google, GitHub, Microsoft, Facebook, LinkedIn, AWS, and enterprise Identity Providers.

It is one of the most frequently asked topics in Spring Security, Java, Microservices, and Solution Architect interviews.

Q1. What is OAuth2?

Answer

OAuth2 (OAuth 2.0) is an authorization framework that allows third-party applications to access protected resources on behalf of a user without exposing the user's credentials.

Instead of sharing usernames and passwords, OAuth2 issues Access Tokens.

OAuth2 Flow

flowchart LR

User --> Application

Application --> AuthorizationServer["Authorization Server"]

AuthorizationServer["Authorization Server"] --> AccessToken["Access Token"]

AccessToken["Access Token"] --> ResourceServer["Resource Server"]

ResourceServer["Resource Server"] --> ProtectedResource["Protected Resource"]

Benefits

  • No password sharing
  • Token-based authorization
  • Secure third-party access
  • Delegated access

Q2. Why do we need OAuth2?

Answer

Without OAuth2:

  • Applications need user passwords.
  • Passwords may be exposed.
  • Revoking access becomes difficult.
  • Third-party integrations become insecure.

OAuth2 solves these problems by issuing limited-access tokens.

Traditional Authentication

flowchart LR

User --> Application

Application --> UsernamePassword["Username & Password"]

UsernamePassword["Username & Password"] --> Server

OAuth2 Authentication

flowchart LR

User --> AuthorizationServer["Authorization Server"]

AuthorizationServer["Authorization Server"] --> AccessToken["Access Token"]

AccessToken["Access Token"] --> Application

Application --> ResourceServer["Resource Server"]

Q3. What is the difference between Authentication and Authorization?

Answer

Authentication verifies who you are.

Authorization determines what you are allowed to access.

Comparison

Authentication Authorization
Verify Identity Verify Permissions
Login Resource Access
Username & Password Roles & Permissions
"Who are you?" "What can you access?"

Authentication vs Authorization

flowchart TD

User --> Authentication

Authentication --> Authorization

Authorization --> ProtectedResource["Protected Resource"]

Interview Tip

OAuth2 is an authorization framework, not an authentication protocol.

Q4. What are the main OAuth2 components?

Answer

OAuth2 defines four main roles.

Component Responsibility
Resource Owner User
Client Application
Authorization Server Issues Tokens
Resource Server Hosts Protected APIs

OAuth2 Components

flowchart TD

User --> ClientApplication["Client Application"]

ClientApplication["Client Application"] --> AuthorizationServer["Authorization Server"]

AuthorizationServer["Authorization Server"] --> AccessToken["Access Token"]

AccessToken["Access Token"] --> ResourceServer["Resource Server"]

Q5. What is an Access Token?

Answer

An Access Token is a credential issued by the Authorization Server that allows access to protected resources.

Characteristics:

  • Short-lived
  • Time-limited
  • Revocable (depending on implementation)
  • Sent with API requests

Access Token Flow

flowchart LR

AuthorizationServer["Authorization Server"] --> AccessToken["Access Token"]

AccessToken["Access Token"] --> Client

Client --> API

API --> ProtectedData["Protected Data"]

Common Format

  • JWT
  • Opaque Token

Q6. What is a Refresh Token?

Answer

A Refresh Token is used to obtain a new Access Token after the current one expires.

It reduces the need for users to log in repeatedly.

Refresh Token Flow

sequenceDiagram
participant User
participant Client
participant AuthorizationServer
User->>Client: Login
Client->>AuthorizationServer: Authenticate
AuthorizationServer-->>Client: Access Token + Refresh Token
Client->>AuthorizationServer: Refresh Token
AuthorizationServer-->>Client: New Access Token

Benefits

  • Better user experience
  • Short-lived access tokens
  • Improved security

Q7. What OAuth2 Grant Types should you know?

Answer

Modern OAuth2 implementations commonly use:

Grant Type Usage
Authorization Code Web Applications
Authorization Code + PKCE SPA & Mobile Apps
Client Credentials Service-to-Service Communication
Refresh Token Renew Access Tokens

The Implicit Grant and Resource Owner Password Credentials Grant are generally discouraged for new applications due to security concerns.

OAuth2 Grant Types

flowchart TD

OAuth2 --> AuthorizationCode["Authorization Code"]

OAuth2 --> AuthorizationCodeWithPkce["Authorization Code with PKCE"]

OAuth2 --> ClientCredentials["Client Credentials"]

OAuth2 --> RefreshToken["Refresh Token"]

Q8. How does OAuth2 work?

Answer

OAuth2 follows these steps:

  1. User requests login.
  2. Client redirects user to Authorization Server.
  3. User authenticates.
  4. Authorization Server issues an Authorization Code.
  5. Client exchanges the code for an Access Token.
  6. Client calls the Resource Server.

OAuth2 Authorization Flow

sequenceDiagram
participant User
participant Client
participant AuthorizationServer
participant ResourceServer
User->>Client: Login
Client->>AuthorizationServer: Authorization Request
AuthorizationServer-->>User: Login Page
User->>AuthorizationServer: Credentials
AuthorizationServer-->>Client: Authorization Code
Client->>AuthorizationServer: Exchange Code
AuthorizationServer-->>Client: Access Token
Client->>ResourceServer: Access Token
ResourceServer-->>Client: Protected Resource

Q9. What are common OAuth2 implementation mistakes?

Answer

Common mistakes include:

  • Long-lived Access Tokens
  • No HTTPS
  • Weak client secret protection
  • No Refresh Token rotation
  • Missing scope validation
  • Missing token validation
  • Hardcoded client secrets
  • Overly broad scopes

Wrong Design

Client

↓

Long-Lived Token ❌

Correct Design

Client

↓

Short-Lived Access Token

↓

Refresh Token ✅

Q10. What are the enterprise best practices for OAuth2?

Answer

Follow these best practices:

  • Always use HTTPS.
  • Use Authorization Code Flow for web applications.
  • Use Authorization Code with PKCE for public clients such as mobile and SPA applications.
  • Use Client Credentials for service-to-service communication.
  • Keep Access Tokens short-lived.
  • Use Refresh Tokens securely.
  • Validate scopes.
  • Protect client credentials.
  • Monitor authentication events.
  • Combine OAuth2 with OpenID Connect for user authentication.

Enterprise OAuth2 Architecture

flowchart TD

User --> IdentityProvider["Identity Provider"]

IdentityProvider["Identity Provider"] --> Oauth2AuthorizationServer["OAuth2 Authorization Server"]

Oauth2AuthorizationServer["OAuth2 Authorization Server"] --> AccessToken["Access Token"]

AccessToken["Access Token"] --> ApiGateway["API Gateway"]

ApiGateway["API Gateway"] --> SpringBootMicroservices["Spring Boot Microservices"]

OAuth2 Security Pipeline

flowchart LR

Authenticate --> AuthorizationCode["Authorization Code"]

AuthorizationCode["Authorization Code"] --> AccessToken["Access Token"]

AccessToken["Access Token"] --> ApiGateway["API Gateway"]

ApiGateway["API Gateway"] --> ResourceServer["Resource Server"]

OAuth2 Components

mindmap
  root((OAuth2))
    Resource Owner
    Client
    Authorization Server
    Resource Server
    Access Token
    Refresh Token
    Scopes

Senior Interview Tip

OAuth2 answers the question:

"Can this application access this resource?"

OpenID Connect answers the question:

"Who is the user?"

Modern enterprise architectures typically combine:

  • OAuth2
  • OpenID Connect
  • Spring Security
  • JWT Access Tokens
  • Refresh Tokens
  • API Gateway
  • Identity Providers (Keycloak, Okta, Microsoft Entra ID)
  • mTLS for service-to-service communication
  • Zero Trust Architecture

Quick Revision

  • OAuth2 is an authorization framework.
  • It allows delegated access without sharing passwords.
  • Access Tokens authorize API access.
  • Refresh Tokens obtain new Access Tokens.
  • OAuth2 defines four core roles.
  • Use Authorization Code Flow for web applications.
  • Use PKCE for public clients.
  • Always use HTTPS.
  • Validate scopes and tokens.
  • Combine OAuth2 with OpenID Connect for enterprise authentication.