OAuth, OIDC, JWT and Cookie Security: A .NET Interview Decision Sheet
A nine-page ASP.NET Core security decision guide covering client and flow selection, JWT validation, cookie and browser threats, resource authorization, rotation and ten interview prompts.
What is inside
- Client and trust-boundary decision matrix
- Authorization Code with PKCE and machine-to-machine flow maps
- JWT signature, algorithm, issuer, audience, time and purpose checklist
- Cookie, CSRF, CORS, XSS and BFF trade-offs
- Resource authorization, IDOR and tenant-isolation checklist
- Key rotation, revocation, safe logging and incident response
- Ten rapid interview questions with concise answer cues
Primary references include RFC 9700, RFC 8725 and ASP.NET Core 10 security guidance.
Try a decision before downloading
A browser application obtains an ID token during sign-in and sends it to your orders API. Its signature is valid. Should the API accept it?
Answer: No. An ID token describes authentication to its intended client; it is not an access token for the orders resource. The API needs a correctly validated access token intended for that API, then a separate authorization decision for the order and tenant. A valid signature alone does not establish audience, purpose, permission, or ownership.
For a browser-cookie design, also state how unsafe requests receive antiforgery protection. HttpOnly limits direct cookie reads by JavaScript; it does not make an injected script harmless or replace CSRF controls.
Use the PDF: Draw your client, identity provider, API, and token-storage boundary. Follow the flow matrix, then use the negative-test checklist to test a wrong audience, expired token, and cross-tenant resource ID. The attached nine-page sheet includes the fuller flow and validation guidance.