This page needs a newer browser to run its tools. You can still read everything here.

Authentication and authorization interview questions

Interview questions on authentication and authorization: warm-ups, then what each harder question tests and how a good answer starts.

15 questions: 5 warm-ups and 10 with model answers · Levels: Fresher to senior

Warm-up questions

Short questions with short answers, each answered in full.

Fresher

What does User.authenticate_by(email_address:, password:) do that User.find_by(email_address:)&.authenticate(password) does not?

Answered in the lesson The Rails 8 authentication generator
Fresher

A Rails 8 model declares generates_token_for :email_verification with expires_in: 2.days and a block that returns email_address. Why is that better than a random token stored in a column?

Everything a verification link needs is already in the string. Its signature cannot be forged, so no lookup is needed to know the link is genuine. Its expiry is signed with it, so no sweep job is needed for links nobody opened. And the block's value is signed with it too, so the link dies the moment the address changes, which is the moment it should. The column version needs a column, an index, a lookup, an expiry comparison, a sweep and the discipline to delete the row whenever the address changes. Two costs come with the Rails shape. The id and the block's value travel in the open as readable JSON, so the block returns nothing confidential. And no single link can be withdrawn on its own: you change what the block returns, and every link for that record stops working together.
From the lesson Sign-up, email verification and settings
Fresher to mid

What is a passkey, in one sentence, and how is it different from a password?

Answered in the lesson MFA, passkeys and social login
Fresher to mid

What is IDOR, and how does scoping queries prevent it?

Answered in the lesson Authorization, roles and multi-tenancy
Fresher to mid

Why does attr_readonly :admin protect the admin flag better than relying only on strong parameters?

Answered in the lesson Admin areas and audit trails

Questions with model answers

What each question tests, the first step of a good answer and the follow-ups to expect.

Mid to senior

The generated authentication keeps one Session row per browser and puts only its id in a signed cookie, instead of storing the whole session in the cookie. Why does a database-backed session suit sign-in, and when is a cookie-only session the wrong choice?
What it tests

Whether the candidate knows the trade-off between a cookie-only session and a server-side session record, and why revocation, a device list and 'log out everywhere' need the row.

First step

Contrast the two. A cookie-only session lives entirely in the browser and cannot be recalled once issued, while a row can be destroyed on the server. Sign-out, 'log out of all devices' and a device list all need something the server can delete, so name what each approach can and cannot do.
Follow-ups
- How does signing out differ between the two, and what can a stolen cookie still do in each?
- What does the sessions row store beyond the user id, and why keep ip_address and user_agent?
- When is a cookie-only session fine, and what does it save?
- How would you add 'log out of all devices' with each approach?
From the lesson The Rails 8 authentication generator
Model answer, Pro. Model answers open with any pass; prices are in the notice on this page.
Opening the model answers with your pass…
Model answers open with any MySmartCoPilot pass.
Pro pass · 1 week₹79$2.99
30 days₹179$5.99
1 year₹1,699$45
One payment; a pass never renews. The price shown is the total you pay: no fees or charges are added at checkout.
Passes can’t be bought right now, so the model answers can’t be opened at the moment. If you have a pass, enter your licence key.
Choose a pass I have a licence key
It also opens every other in-depth part in Learn and every Pro tool. Sales are final, except where the law gives you a right to withdraw, for example in the EU and the UK (refund policy).
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
Mid to senior

Your team is starting a Rails 8.1 app. Argue for using the built-in authentication generator rather than a gem such as Devise or Rodauth, and say where that choice stops being the right one.
What it tests

Whether the candidate can weigh owning readable generated code against a gem's breadth, and name the features that tip the decision toward a gem.

First step

List what the generator already gives, sign-in, sign-out, a password reset, a rate limit and a timing-safe login, and what it omits, sign-up, email confirmation, OAuth, multi-factor and account lockout. The decision is about how much of that omitted list you would otherwise build and maintain yourself.
Follow-ups
- What do you gain by owning the generated code outright?
- Which missing features most often push a team to Devise or Rodauth?
- How hard is it to move from the generator to a gem later?
- What are the risks of adopting a gem you have not read?
From the lesson The Rails 8 authentication generator
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
Mid to senior

Kaksha sends three one-time links: an email verification, a password reset, and an invitation to a teacher who has no account yet. For each, choose a signed token from generates_token_for or a row in a table, and defend the choice against the option you did not take.
What it tests

Choosing between a self-describing signed token and a stored row from what each link must support: single use, withdrawal of one link, an audit trail, and a record for the link to name.

First step

List what each link must support before naming a mechanism: must a second opening be refused, must one link be withdrawn on its own, must there be a record of who opened what, and does a row have to exist for the link to name at all. Then match each mechanism against those four answers.
Follow-ups
- A mail scanner opens the link before the person does. What breaks, and for which of the three?
- How do you make a signed link refuse a second opening without adding a table?
- secret_key_base is rotated after an incident. What happens to links already sent?
- Which link needs a row for its audit trail, and what belongs in that row?
From the lesson Sign-up, email verification and settings
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 5 minutes
Mid to senior

A guardian asks for a copy of their data, then asks for the account to be deleted. The export reads nine tables and comes to about 40 MB; the deletion touches fee receipts the accounts team must keep for years. Design both as jobs, and say how you would show each one finished.
What it tests

Moving slow multi-table work out of the request, making a job safe to repeat and to resume, deciding what a deletion keeps, and evidencing both to the person who asked.

First step

Split each request into a mark and a job: the controller writes a requested_at column and enqueues, so the browser is answered at once. Then decide each job's unit of work, what it records as it goes, and what a second delivery of the same job must do.
Follow-ups
- The export job dies while reading the ninth table. What does the retry do?
- What does the account holder see while each job waits, and when it is done?
- Which rows survive the deletion, and what is removed from the ones that stay?
- A month later, how do you show that one deletion really ran?
From the lesson Sign-up, email verification and settings
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 6 minutes
Mid to senior

We lose TOTP seeds in a backup. An attacker who reads the backup can now do what, and how do you stop it?
What it tests

Explain the seed is the private key, encryption at rest, recovery codes as a fallback

First step

Recognise that the TOTP seed lets anyone generate valid codes for that user
Follow-ups
- What encryption approach does Rails 8 offer for sensitive columns?
- How should recovery codes be stored and consumed?
- What happens if a user loses both their phone and their recovery codes?
From the lesson MFA, passkeys and social login
Model answer, Pro.
In the answer:
- Model answer
- How Rails encrypts the column
- Recovery codes as a fallback
- Follow-ups
- Common mistakes
- Rubric
- Variants
- about 5 minutes
Mid to senior

OmniAuth 2.x starts provider login with POST. Why, and what does omniauth-rails_csrf_protection add?
What it tests

Explain login CSRF, the switch from GET to POST, and the Rails authenticity token check

First step

Describe the login-CSRF attack that a GET link enables
Follow-ups
- What would happen if the app still accepted GET requests to /auth/:provider?
- How does the CSRF meta tag reach the POST request?
- When linking a provider to an existing account, what email rule prevents account takeover?
From the lesson MFA, passkeys and social login
Model answer, Pro.
In the answer:
- Model answer
- Why POST stops the forged start
- What omniauth-rails_csrf_protection adds
- Follow-ups
- Common mistakes
- Rubric
- Variants
- about 5 minutes
Mid to senior

After a deploy, a teacher at Centre A can see Centre B's students by changing the id in the URL. What went wrong, and how do you fix it without taking the site offline?
What it tests

Identify missing scope as root cause, explain immediate mitigation, fix the query, add IDOR test

First step

Recognise that the controller is using Student.find(params[:id]) instead of current_account.students.find(params[:id])
Follow-ups
- How would you find other controllers with the same bug?
- What test would have caught this before deploy?
- Should you notify Centre B that their data was exposed?
From the lesson Authorization, roles and multi-tenancy
Model answer, Pro.
In the answer:
- Model answer
- Immediate mitigation
- The proper fix
- Finding other controllers with the same bug
- The test that would have caught this
- Should you notify Centre B?
- Follow-ups
- Common mistakes
- Rubric
- about 3 minutes
Mid to senior

Your SaaS has 50 coaching centres today and expects 500 next year. You need per-tenant backups and cross-tenant analytics. Which tenancy design fits, and why?
What it tests

Evaluate shared schema against database-per-tenant, consider the trade-offs, recommend with reasoning

First step

Recognise that cross-tenant analytics rules out database-per-tenant because you would need to open every database
Follow-ups
- What if strict isolation becomes a requirement later?
- How does acts_as_tenant help with the discipline problem?
- What migration strategy would you use to move from shared schema to database-per-tenant?
From the lesson Authorization, roles and multi-tenancy
Model answer, Pro.
In the answer:
- Model answer
- Why shared schema fits
- The discipline problem
- What if strict isolation becomes a requirement?
- Follow-ups
- Common mistakes
- Rubric
- about 4 minutes
Mid to senior

A coaching SaaS has eight admin resources. Six are plain lists and forms; fee waivers and refunds need multi-step screens drawn by the design team, with an audit row for every step. The licence policy is MIT-only. Would you build the whole admin by hand, use Administrate for all of it, or mix the two, and why?
What it tests

Whether the candidate splits the admin by kind of resource instead of picking one tool, keeps one role check across Administrate's controllers and hand-built ones, and records each step of a flow as its own audit row

First step

Sort the eight resources into plain lists and forms versus drawn flows, weigh what each option costs for each group, then ask where the role check and the audit rows live when both kinds of controller share /admin
Follow-ups
- How would one role check cover Administrate's controllers and your own?
- How do you get one audit row per step of a multi-step flow?
- What would make you move the two custom flows into Administrate later?
From the lesson Admin areas and audit trails
Model answer, Pro.
In the answer:
- Model answer
- Follow-ups
- Common mistakes
- Rubric
- Variants
- about 4 minutes
Mid to senior

A compliance review asks the team to log every change to fee waivers with the actor, the before and after, and the request id. Would you add paper_trail, or grow an AuditEvent model as the lesson did, and how would you handle personal data in the diff?
What it tests

Compare paper_trail's versions table with a hand-written AuditEvent, name the schema and growth cost of each, show how to keep names and emails out of the diff

First step

Picture the two tables (paper_trail versions vs AuditEvent rows) and ask what the audit must answer, then decide which schema fits
Follow-ups
- How would you shrink paper_trail's table if it grew to 40 GB in three months?
- How would you prove the audit row is written exactly once per state change?
- What belongs in the diff and what does not, under OWASP's guidance?
From the lesson Admin areas and audit trails
Model answer, Pro.
In the answer:
- Model answer
- Personal data in the diff
- Follow-ups
- Common mistakes
- Rubric
- Variants
- about 6 minutes

The lessons of this module

The Rails 8 authentication generator Free lesson, Pro answers: 10 minutes
Sign-up, email verification and settings Free lesson, Pro answers: 20 minutes
MFA, passkeys and social login Free lesson, Pro answers: 10 minutes
Authorization, roles and multi-tenancy Free lesson, Pro answers: 10 minutes
Admin areas and audit trails Free lesson, Pro answers: 20 minutes

All Ruby on Rails interview questions · The Ruby on Rails track

Warm-up questions

What does User.authenticate_by(email_address:, password:) do that User.find_by(email_address:)&.authenticate(password) does not?

A Rails 8 model declares generates_token_for :email_verification with expires_in: 2.days and a block that returns email_address. Why is that better than a random token stored in a column?

What is a passkey, in one sentence, and how is it different from a password?

What is IDOR, and how does scoping queries prevent it?

Why does attr_readonly :admin protect the admin flag better than relying only on strong parameters?

Questions with model answers

The generated authentication keeps one Session row per browser and puts only its id in a signed cookie, instead of storing the whole session in the cookie. Why does a database-backed session suit sign-in, and when is a cookie-only session the wrong choice?

Your team is starting a Rails 8.1 app. Argue for using the built-in authentication generator rather than a gem such as Devise or Rodauth, and say where that choice stops being the right one.

Kaksha sends three one-time links: an email verification, a password reset, and an invitation to a teacher who has no account yet. For each, choose a signed token from generates_token_for or a row in a table, and defend the choice against the option you did not take.

A guardian asks for a copy of their data, then asks for the account to be deleted. The export reads nine tables and comes to about 40 MB; the deletion touches fee receipts the accounts team must keep for years. Design both as jobs, and say how you would show each one finished.

We lose TOTP seeds in a backup. An attacker who reads the backup can now do what, and how do you stop it?

OmniAuth 2.x starts provider login with POST. Why, and what does omniauth-rails_csrf_protection add?

After a deploy, a teacher at Centre A can see Centre B's students by changing the id in the URL. What went wrong, and how do you fix it without taking the site offline?

Your SaaS has 50 coaching centres today and expects 500 next year. You need per-tenant backups and cross-tenant analytics. Which tenancy design fits, and why?

A compliance review asks the team to log every change to fee waivers with the actor, the before and after, and the request id. Would you add paper_trail, or grow an AuditEvent model as the lesson did, and how would you handle personal data in the diff?