Full-Stack Engineer
How do you handle authentication in a web app, and where do you store the user's session or token?
What the interviewer is looking for
- This question tests backend & api development. Designs endpoints clearly, handles authentication and validation correctly, and understands the request lifecycle end to end.
- Strong answers: Sessions or tokens with trade-offs, secure http-only cookies, expiry and refresh, protection against cross-site attacks, and server-side authorisation checks.
- Likely follow-up: How would you log a user out of every device at once?
Another way it may be asked: A user logs in. How does the app remember who they are on the next request, and how do you keep that safe?
A structure to follow: Answer, explain, example, limits
- Step 1
Answer
Give your direct answer in the first sentence so the interviewer knows where you are going.
- Step 2
Explain
Say how it works or why you would do it that way, in plain words before jargon.
- Step 3
Example
Anchor it in something you have actually done or seen, with the detail that shows hands-on experience.
- Step 4
Limits
Say when your approach would not be the right one. It shows judgement.
This is guidance on shape, not a script. Use your own real experience and facts; never invent details to fill a gap. See the STAR guide and answer frameworks.
Common slips
- Reciting a definition without showing you have applied it.
- Using terms you cannot explain if asked a level deeper.
- Claiming experience beyond what you can discuss in detail.
How to practise it
Say the answer in 90 seconds, then answer the follow-up as if it were a new question.
Related questions
- What happens, step by step, when a user submits a sign-up form on a website, from the browser all the way to the database?
- Walk me through how you would build a page that shows a list of items from a server, including what the user sees while it loads.
- If you were storing users, their posts and comments on those posts, how would you set up the tables and relationships?
- Tell me about a feature you built from the database all the way to the user interface. What decisions did you make along the way?
- A user reports that saving their profile sometimes fails with no error message. How would you figure out whether it's a frontend or backend problem?