Authentication & Authorization

"Where would you store an access token?" is one of the most common frontend interview questions, and the expected answer is a trade-off discussion, not a one-liner.

This module covers the full identity picture: cookie sessions vs stateless JWT, the OAuth 2.0 Authorization Code flow with PKCE, OIDC identity tokens, and how SSO works from the browser's point of view.

You will learn token lifetimes, silent and rotating refresh, handling 401s with a single-flight refresh queue, revocation and logout across tabs, and why httpOnly + SameSite cookies beat localStorage under XSS.

It closes with authorization: authentication versus authorization, RBAC versus ABAC, protecting routes in the App Router with middleware, and why client-side guards are UX rather than security.

Phase 7 (Week 7) of the interview roadmap. Senior Track spans modules 1–19; the Staff Track starts at module 20.