Your app puts the token the server returned at login into the header of every request. An interviewer asks when that token is created and when it expires, so how do you answer?
The server issues the token when login succeeds, you split it into a short-lived access token (minutes to an hour) and a long refresh token, and the server decides expiry while the client renews on a 401 or on the expiry time.
SecurityShort answerAdvanced
In a financial app, how do you decide when a security requirement conflicts with user…
#session
SecurityShort answerExpert
Bots call your API directly and clear out the coupons. How do you use App Attest so the…
#app-attest
SecurityShort answerAdvanced
Several apps from one company (the main app, a payments app, a cloud app) should share…
#session
SecurityShort answerAdvanced
If you designed the protocol between your app and the server yourself, how would you let…
#replay