Loading…
Resources, verbs, status codes, versioning, pagination, idempotency and errors.
A request arrives with a valid token for user 42 and asks to delete project 7. Which part of handling it is authentication, which part is authorization, and why is passing the first not enough?
Your API accepts bearer tokens. What property of a bearer token makes HTTPS mandatory for every call, and what goes wrong over plain HTTP?
Why should an API not accept an API key or access token as a query
string parameter, like /reports?api_key=abc123?
A developer stores the user's email, role and home address in a JWT, assuming nobody can read it without the secret key. What is wrong with that assumption?
A teammate says your strict CORS policy means only your own front end can call the API, so a script running on someone else's server cannot. Is that right? Explain what CORS actually controls.
Why do OAuth-style systems give a client both a short-lived access token and a long-lived refresh token, rather than one token that lasts a long time?