Backend · Mid-level · Theory

You have an endpoint, GET /orders/{id}, that requires authorization and returns an order. A security review said there's a hole in it. What's the most likely problem, and how do you close it?

~4 min by voice

How to approach it

They're checking whether you can tell authentication apart from object-level authorization and whether you recognize the classic IDOR/BOLA vulnerability. What matters is whether you understand how to close it systematically, not with a one-off patch.

Have you seen this question in a real interview?

Answers0

Avg. score—

Strong—

Practiced0

Topics

authorization web security

Similar questions

You're choosing between server-side sessions and JWTs for authentication in a web application. How will you choose, and what problems will you run into with each approach? Mid-level Design an authorization system for a B2B SaaS product where each client company has its own users, roles, and permissions to individual resources. Senior You're choosing between stateless JWTs and server-side sessions for a web application and a mobile client. How would you make the decision? Senior What is SQL injection, and how do you protect against it? Junior What's the difference between authentication and authorization? And once a user has logged in, how does the server know who's making a request? Junior

Answer by voice

The interviewer will ask this question and listen. Think out loud and ask for a hint if you need one. When you're done, pause or tap “That's my answer”. In about a minute, your score and the points you covered show up here.

Best with headphones · ~4 min