Explain how browser authentication works with JWTs
Company: Microsoft
Role: Software Engineer
Category: Software Engineering Fundamentals
Difficulty: hard
Interview Round: Onsite
Explain, at a high level, how authentication typically works in a browser-based web app when using JWTs.
Cover:
- Where the token is stored (e.g., memory, `localStorage`, cookies) and trade-offs.
- How the browser sends the token on subsequent requests.
- Refresh tokens / session renewal patterns.
- Common security risks (XSS, CSRF) and mitigations.
- How this differs from traditional server-side sessions.
Quick Answer: This question evaluates understanding of browser-based authentication with JWTs, covering token storage trade-offs, how tokens are sent with requests, refresh token/session renewal patterns, common security risks (XSS, CSRF), and differences from traditional server-side sessions.