Security Fundamentals

Intermediate · 18 min read · High-Level Design, Reliability, Security & Operations

Authentication, authorization, OAuth 2.0/OIDC, JWTs, encryption and secrets.

Security is rarely the headline of a design interview, but gaps are noticed: an API that trusts a userId from the request body, tokens that can't be revoked, data stored unencrypted, secrets in config files.

Authentication vs authorization

A request can be perfectly authenticated and still unauthorised (a logged-in user trying to read someone else's invoice). Most real-world breaches of APIs are authorization bugs — Broken Object Level Authorization tops the OWASP API Security Top 10.

Sessions vs tokens

After login, the server creates a session record (in Redis or a database) and gives the browser an opaque session ID in a cookie.

OAuth 2.0 and OpenID Connect

The recommended flow for web, mobile and single-page apps:

Authorization models

Whatever the model: check authorization on the server for every request, at the object level ("does this user own invoice 1001?"), not just "is the user logged in?". Centralise policy logic (a library or policy engine such as OPA) so it's applied consistently.

Protecting data

Secrets management

Common attacks and defences

Security in a design interview

A concise paragraph covers what interviewers look for:

Interview questions

  • JWT or server-side sessions — which would you choose?
  • What is PKCE and why is it needed?
  • How should passwords be stored?

Practice

Write your answer before opening the suggested one. If you mark it "Partly" or "Missed it", it comes back in your review deck.

Further reading

Key takeaways

  • Authentication proves identity; authorization checks each action — most API breaches are authorization bugs.
  • Sessions are easy to revoke; JWTs are stateless but hard to revoke — use short-lived access tokens with revocable refresh tokens.
  • Use OAuth 2.0 Authorization Code with PKCE for delegated access and OIDC for login; client credentials or mTLS for services.
  • Encrypt in transit and at rest with KMS-managed keys; hash passwords with Argon2id, scrypt or bcrypt.
  • Manage secrets centrally, rotate them, and apply least privilege.

Previous: Multi-Region Architecture · Next: Design a URL Shortener