OAuth 2.0 flow in HLD - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Identify the main purpose of the OAuth 2.0 Authorization Code flow

Which of the following best describes the main purpose of the OAuth 2.0 Authorization Code flow?

A To directly provide the client application with the user's password for authentication.

B To allow the client application to refresh the access token without any prior authorization.

C To enable the client application to access resources without any user interaction or consent.

D To allow a client application to obtain an access token by exchanging an authorization code received after user consent.

💡 Hint

Think about how the client gets permission from the user before accessing protected resources.

The Authorization Code flow is designed to let a client app get an access token by first getting an authorization code after the user consents. This code is then exchanged securely for the token.

❓ Architecture

intermediate

Select the correct sequence of steps in OAuth 2.0 Authorization Code flow

What is the correct order of steps in the OAuth 2.0 Authorization Code flow?

A 1,2,3,4

B 2,1,3,4

C 1,3,2,4

D 3,1,2,4

💡 Hint

Remember the user must first login and consent before the client gets the code.

The user first logs in and consents (step 1), then the authorization server sends an authorization code (step 2). The client exchanges this code for an access token (step 3), which it uses to access resources (step 4).

❓ scaling

advanced

Choose the best approach to scale an OAuth 2.0 Authorization Server

Which approach best supports scaling an OAuth 2.0 Authorization Server to handle millions of users securely and efficiently?

A Disable token expiration to reduce database lookups and improve performance.

B Store all tokens and sessions in a single database instance to ensure consistency.

C Use a stateless token design like JWTs and deploy multiple authorization server instances behind a load balancer.

D Use a monolithic server with synchronous blocking calls to handle all token requests.

💡 Hint

Think about how to avoid bottlenecks and maintain security with many users.

Using stateless tokens like JWTs allows multiple servers to validate tokens without querying a central database, enabling horizontal scaling. Load balancers distribute requests efficiently.

❓ tradeoff

advanced

Evaluate tradeoffs between using JWT access tokens vs opaque tokens

What is a key tradeoff when choosing JWT access tokens over opaque tokens in OAuth 2.0?

A JWT tokens allow stateless validation but can be larger and harder to revoke immediately.

B JWT tokens require a central database lookup for every request, increasing latency.

C Opaque tokens contain user credentials, making them less secure than JWTs.

D Opaque tokens are self-contained and can be validated without contacting the authorization server.

💡 Hint

Consider token size, validation method, and revocation capabilities.

JWT tokens carry all info inside and can be validated without server calls, but revoking them immediately is difficult. Opaque tokens require server checks but can be revoked easily.

❓ estimation

expert

Estimate token storage requirements for an OAuth 2.0 system

An OAuth 2.0 system issues 10 million access tokens daily. Each token record stored in the database requires 1 KB. If tokens expire after 1 hour and the system keeps expired tokens for 24 hours for audit, approximately how much storage in GB is needed to store all tokens for 24 hours?

A 1 TB

B 10 GB

C 240 GB

D 100 GB

💡 Hint

Calculate tokens per hour, multiply by 24 hours, then convert KB to GB.

10 million tokens issued daily, kept for 24 hours: 10M tokens * 1 KB = 10M KB ≈ 9.77 GB ≈ 10 GB (B).