Authentication Protocols and Standards Questions

In depth understanding of authentication and federation standards and how to design secure authentication flows. Topics include OAuth 2.0 flows such as authorization code with proof key for code exchange, client credentials and refresh token handling; OpenID Connect identity layer; Security Assertion Markup Language federation; multi factor and two factor authentication; passwordless approaches such as WebAuthn; token types and validation including JSON Web Tokens, token lifecycle and revocation strategies; session management for web and native applications; secure storage and transmission of tokens; single sign on and identity federation design; and common attacks and mitigations such as token theft, replay and cross site request forgery. Candidates should be able to design authentication architectures and reason about usability versus security trade offs.