Understanding Authentication vs Authorization: Sessions, Tokens, and OAuth2 Basics Quiz

Test your knowledge of authentication, authorization, sessions, tokens, and OAuth2 basics with this beginner-friendly quiz. This quiz covers core concepts to help you distinguish between AuthN and AuthZ, understand sessions and tokens, and grasp essential OAuth2 terms and functionality.

1. Authentication vs Authorization Basics

   Which process determines whether a user is permitted to access a specific resource after verifying their identity?

   1. Authenticaton
   2. Authorization
   3. Authentication
   4. Authentification

   Explanation: Authorization checks a user's permissions and decides what resources they can access, coming after authentication has verified their identity. Authentication only verifies who the user is, not what they can do. 'Authenticaton' and 'Authentification' are common typos and are not correct technical terms in this context.

2. Purpose of Sessions

   In a typical web application, what is the primary purpose of using a session after a successful login?

   1. To store application logs securely
   2. To authorize user roles for database access
   3. To encrypt all traffic between client and server
   4. To maintain a user's authentication state across requests

   Explanation: Sessions primarily keep a user logged in by storing their authentication state on the server or client, allowing multiple interactions without re-authenticating. They are not used for authorization decisions, which instead relate to role checks. Sessions do not handle application logs or directly encrypt traffic; those are separate functions.

3. Tokens in Authentication

   What is the typical role of an access token in a token-based authentication system?

   1. It tracks website analytics for a user
   2. It stores the user's password securely
   3. It encrypts login credentials during transit
   4. It proves the user's identity and grants access to resources

   Explanation: An access token acts as digital proof of identity after login and is used by applications to decide if a user can access resources. Access tokens do not store passwords, track analytics, or directly encrypt credentials. Those functions are managed by different components or security measures.

4. OAuth2 Grant Types

   In OAuth2, which grant type is commonly used by single-page applications (SPAs) or mobile apps when direct user login is required?

   1. Authorization Code Grant
   2. Refresh Token Grant
   3. Client Credentials Grant
   4. Resource Owner Password Grant

   Explanation: Single-page applications or mobile apps typically use the Authorization Code Grant to securely obtain access tokens. The Resource Owner Password Grant is discouraged due to security risks and is less common today. The Refresh Token Grant is used for renewing access tokens, and the Client Credentials Grant is intended for application-to-application interactions without a user.

5. AuthN vs AuthZ Example Scenario

   If a user logs in with their username and password and then tries to open an admin dashboard but is blocked, which process caused the denial?

   1. Session management
   2. Authenticaton
   3. Authentication
   4. Authorization

   Explanation: Authorization determines if the logged-in user has the proper permission to access the admin dashboard and blocks them if not. Authentication already happened during login, so it is not responsible for the denial at this stage. 'Authenticaton' is a misspelling, and session management maintains the user's state but does not decide access permissions.

6. Token Expiry

   Why do authentication tokens often include an expiration time?

   1. To increase the size of the token for better encryption
   2. To keep users logged in permanently
   3. To reduce security risks if a token is leaked
   4. To remove the need for authorization checks

   Explanation: Expiration limits how long a leaked or stolen token remains valid, reducing security risks. Making the token larger does not enhance encryption on its own, and tokens are not meant to keep users logged in forever. Expiration also does not replace the need for ongoing authorization checks.

7. Main OAuth2 Purpose

   What problem does OAuth2 primarily solve in modern web applications?

   1. Managing hardware firewalls
   2. Encrypting all web server data by default
   3. Allowing secure delegated access to user data without sharing passwords
   4. Providing faster graphics processing

   Explanation: OAuth2 lets apps request access to user data from another service without exposing the user's real password, using tokens instead. Web server encryption, graphics processing, and hardware firewall management are not connected to OAuth2's primary purpose.

8. Session Store Location

   Where is session data most commonly stored to maintain user authentication in web applications?

   1. On external graphics cards
   2. Within printed documents
   3. On the server or in cookies on the client
   4. Directly in the user's password

   Explanation: Session data is usually stored on the server (for security) or within cookies on the client to identify the user. Storing session information in passwords, graphics cards, or physical documents is not a secure or standard practice.

9. Refresh Token Use

   What is the main function of a refresh token in an OAuth2 system?

   1. To increase download speed
   2. To save a copy of the original password
   3. To obtain a new access token after the old one expires
   4. To encrypt data stored in the database

   Explanation: A refresh token allows clients to request new access tokens automatically, so users do not need to log in again. Refresh tokens are not used to store passwords, encrypt database data, or improve download speeds.

10. Token vs Password Transmission

    Why is sending a token instead of a password considered safer when accessing protected resources?

    1. Tokens are only used for graphics processing tasks
    2. Passwords are much shorter and easier to guess
    3. Tokens typically have limited lifetime and permissions, reducing risk if intercepted
    4. Passwords cannot be stolen through phishing attacks

    Explanation: Transmitting tokens is safer because they can be set to expire soon and their access can be limited; this minimizes harm if captured. Passwords are sensitive and usually provide full account access, not just limited permissions. Tokens are unrelated to graphics, and unfortunately, passwords can be phished, contrary to one of the distractors.