Josh Sizer

cloud engineer | cka

[Domino's Pizza UK @Dominos_UK]

BREAKING NEWS

[Josh Sizer @JoshSize]

@ElonMuskAOC Apple, obviously

[Josh Sizer @JoshSize]

@ibuildthecloud @stefanprodan Push deploys are cool until you have n clusters

@stefanprodan any way I could help with the Gating RFC in flux?

[Bindu Reddy @bindureddy]

All of the billions spent on AI innovation just so we can get these beautiful cat videos

[Darren Shepherd @ibuildthecloud]

Anyone know of a good article that clearly articulates the "take an interface, return a struct" idiom in go? I don't have the correct words to explain this and just how powerful it is.

[memenetes @memenetes]

won't somebody please think of the children

[Spill The Memes @SpillTheMemes]

👀

[The Dalbo Dog @Dalbodog]

���😁

[Elon Musk @elonmusk]

Improved version of @Neuralink update

[System Design Codex @ProgressiveCod2]

I asked this question to 11 candidates and only 3 managed to answer:

“What’s the difference between Session-based authentication and JWTs?”

The rest of the candidates just dropped some basic keywords and got things mixed up.

But why did I ask this question?

Because the candidates mentioned that they implemented Sessions and JWTs in their projects.

So it was a good follow-up question to judge whether they knew what they claimed.

In this case, the interviewer isn’t usually expecting a perfect answer unless it’s not an API Security Engineer role or something like that.

But a basic understanding of these concepts can boost your chances.

Here are a few important points that can help you answer this question:

✅ Session-Based Authentication

In this approach, you store the session information in a database or session store and give a session ID to the user.

For the user, it’s similar to just getting the Ticket ID of their flight. All other details are stored in the airline’s database.

Here’s how it works:

- The user makes a login request and the frontend app sends the request to the backend server

- The backend creates a session using a secret key and stores the data in session storage

- Then, the server sends a cookie back to the client with the unique session ID

- The user makes a new request to view another page and the browser sends the session id along with it.

- The server verifies the user using this ID.

✅ JWT-based Authentication

In the JWT-based approach, you don’t store the session information in the session store.

The entire information is available within the token.

It’s like getting the flight ticket along with all the details available on the ticket but encrypted.

Here’s how it works:

- The user makes a login request and it goes to the backend server

- The backend server verifies the credentials and issues a JWT. The JWT is signed using a private key. No session storage is involved.

- The JWT is passed to the browser using a cookie.
For every subsequent request, the browser sends the cookie with the JWT

- The server verifies the JWT using the secret private key and extracts the user info.

✅ What’s the better approach - Session or JWTs?

In a general sense, you can give the favorite answer of every software engineer.

“It depends”

JWTs offer some cool benefits when compared to sessions such as:

- No separate storage

- Easier to scale the client and server

But JWTs also have some disadvantages:

- Invalidating a JWT is not easy. With session, you can simply delete them from the session store.

- The data in the JWT can become stale

- The JWTs aren’t exactly small when it comes to size

Ultimately, the choice depends on the security requirements of your application.

If you can confidently explain this much, you are already ahead of many candidates.

Of course, there can be several additional follow-up questions.

👉 So - what other points do you think can be added to boost a candidate's chances?

[Catalin @catalinmpit]

Just use Postgres for everything.

[Nature is Amazing ☘️ @AMAZlNGNATURE]

The side of planet Earth we aren't used to seeing.

[I LOVE ATLANTA @4oh4dee]

When you unexpectedly dap up the President at Waffle House 🫱🏾‍🫲🏻

[Dave Portnoy @stoolpresidente]

That's it folks. Cancel the election. Let's settle this on the golf course. Winner takes all. The only way to do it.

[Francisco Tolmasky (@[email protected]) @tolmasky]

If I was @1Password’s VC, my value-add would be to tell them to rename it. I have told people “you should use 1password”, and have them respond “oh I do!”, only to later discover that they use “one password” for every service, the exact opposite of the right thing to do.

[Darren Shepherd @ibuildthecloud]

And that was the last we ever heard of Engin Diri.

[Josh Sizer @JoshSize]

@save_dizer 100% agree

[Josh Sizer @JoshSize]

Thank you @peripheryband for spending 2,653 minutes with me this year on @Spotify. You are my #1. #2020Wrapped https://t.co/S59yDl4vjm