Authentication, JWT and Password Hashing
50 min · Advanced
Security questions come up in almost every Spring Boot interview: how login works, why passwords are hashed, what is inside a JWT, and why an API answers 401 or 403. Section 17 (Spring Security & Authentication) built all of it into ShopLite; this lesson revises it as short, exact interview answers.
Topics in this lesson
- Authentication vs authorisation; 401 vs 403
- Password hashing with BCrypt, and salting
- JWT structure, signing and expiry: the stateless login flow
- The Spring Security filter chain; CORS and CSRF
- Traps: secrets in the payload, no expiry, and other JWT mistakes
Interview questions this lesson answers
- What is the difference between authentication and authorisation?
- A logged-in USER calls an ADMIN-only endpoint, and an anonymous user calls the same endpoint. Which status does each get, and why?
- A customer asks for another customer's order. 403 or 404?
- What is the difference between hashing, encryption and encoding?
- Why are passwords hashed and not encrypted?
- What is a salt?
- What is a pepper, and how is it different from a salt?
- Why BCrypt and not SHA-256 for passwords?
- What is the BCrypt cost factor?
- If BCrypt gives a different hash every time, how does login work?
Sign in free to continue this lesson
Create a free account to read every lesson, practise with the exercises and keep track of your progress.