Angular Authentication - Interview Questions

Group 16: Authentication & JWT with ASP.NET Core — Interview Quick Revision

1. How does JWT authentication work between Angular and ASP.NET Core Web API?

Angular sends login credentials to ASP.NET Core Web API. After successful authentication, the API issues a JWT, which Angular sends with subsequent requests.

Angular Login → Web API → Validate Credentials
             ← JWT Token
Angular → Bearer Token → Web API → Validate JWT → Response

2. Where should the JWT token be generated?

JWT tokens should be generated by a trusted authentication server, such as ASP.NET Core Web API or an identity provider, after successful authentication.

Key Point: Never generate trusted authentication tokens in Angular.

3. Where should the JWT token be validated?

JWT tokens must be validated on the ASP.NET Core Web API side using JWT Bearer authentication middleware. Angular may inspect token expiry for UI purposes but cannot securely validate authorization.

4. How does Angular send a JWT to ASP.NET Core?

Angular sends the access token through the Authorization header using the Bearer authentication scheme, typically with an HTTP interceptor.

const authReq = req.clone({
  setHeaders: { Authorization: `Bearer ${token}` }
});

5. How does ASP.NET Core validate a JWT?

ASP.NET Core validates the JWT's signature, issuer, audience, and expiration using JWT Bearer middleware. Invalid tokens result in a 401 Unauthorized response.

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options => options.TokenValidationParameters = validationParameters);

6. How do you protect ASP.NET Core API endpoints?

Use the [Authorize] attribute on controllers or actions. Only authenticated users with valid credentials can access protected endpoints.

[Authorize]
[HttpGet("profile")]
public IActionResult GetProfile() => Ok();

7. How do you protect Angular routes?

Use Angular route guards, such as CanActivateFn, to prevent unauthorized navigation. Guards check authentication state before allowing route activation.

export const authGuard: CanActivateFn = () =>
  inject(AuthService).isAuthenticated() || inject(Router).createUrlTree(['/login']);

8. What is the difference between authentication and authorization?

9. How do roles work between Angular and ASP.NET Core?

ASP.NET Core assigns roles such as Admin or User through claims. Angular can use roles to control UI visibility, while ASP.NET Core enforces access permissions.

10. How do claims work?

Claims are key-value pairs representing information about an authenticated user, such as UserId, Email, and Role. They are used for authorization decisions.

new Claim(ClaimTypes.NameIdentifier, user.Id.ToString());
new Claim(ClaimTypes.Role, "Admin");

11. How do you implement role-based authorization?

Use [Authorize(Roles = "...")] to restrict API endpoints to specific roles. ASP.NET Core checks the authenticated user's role claims.

[Authorize(Roles = "Admin")]
public IActionResult DeleteUser() => Ok();

12. How do you implement policy-based authorization?

Policy-based authorization defines reusable access rules using claims, roles, or custom requirements. Apply policies using [Authorize(Policy = "...")].

builder.Services.AddAuthorization(o => o.AddPolicy("AdminOnly", p => p.RequireRole("Admin")));
[Authorize(Policy = "AdminOnly")]

13. What is an access token?

An access token is a short-lived credential used to access protected APIs. It contains authentication and authorization information, typically as a JWT.

Key Point: Access tokens should have limited validity and scope.

14. What is a refresh token?

A refresh token is a long-lived, high-value credential used to request a new access token without requiring the user to log in again. It is often an opaque random string.

15. Why do we need refresh tokens?

Refresh tokens allow applications to use short-lived access tokens while maintaining user sessions. They reduce repeated logins without extending access-token validity.

16. How do you implement refresh-token flow?

When an access token expires, Angular requests a new token using a valid refresh token. ASP.NET Core validates the refresh token and ideally rotates it.

Access Token Expired
        ↓
Angular → POST /api/auth/refresh
        ↓
ASP.NET Core → Validate Refresh Token
        ↓
Issue New Access Token + Rotate Refresh Token
        ↓
Angular → Retry Original API Request

17. What happens when an access token expires?

ASP.NET Core returns 401 Unauthorized for an expired access token. Angular can attempt a refresh and retry the request once; if refreshing fails, the user must log in again.

18. How should logout work?

Angular should clear authentication state and call the backend to revoke the refresh token or session. The server should also clear authentication cookies where applicable.

Key Point: A previously issued JWT may remain valid until expiration unless additional server-side revocation is implemented.

19. Where should tokens be stored?

Prefer keeping access tokens in memory and refresh tokens in Secure, HttpOnly, SameSite cookies where appropriate. Avoid exposing long-lived tokens to JavaScript.

20. What are the security risks of storing tokens in localStorage?

localStorage is accessible through JavaScript, so XSS attacks can steal stored tokens. Tokens also persist across browser restarts until explicitly removed.

Key Point: Avoid storing refresh tokens in localStorage.

21. What are the trade-offs between browser storage and secure cookies?

Key Point: Cookies reduce direct token exposure to JavaScript but do not eliminate XSS or CSRF risks.

22. Why must ASP.NET Core perform authorization even when Angular has route guards?

Angular route guards execute in the browser and can be bypassed. ASP.NET Core must independently validate authentication and permissions for every protected API request.

Angular Route Guard → UI Navigation Protection
                            |
                            v
ASP.NET Core [Authorize] → Server-Side Security
                            |
                            v
                     Protected Resource

Important Interview Revision Points

Angular + ASP.NET Core JWT Authentication Flow

Angular Application
        |
        | 1. Login (Username + Password)
        v
ASP.NET Core Web API
        |
        | 2. Validate Credentials
        | 3. Generate Access + Refresh Tokens
        v
Angular Application
        |
        | 4. Store Tokens Securely
        | 5. Send Bearer Access Token
        v
JWT Authentication Middleware
        |
        | 6. Validate Token
        v
Authorization Middleware
        |
        | 7. Check Roles / Claims / Policies
        v
Protected API Controller
        |
        | 8. Execute Business Logic
        v
SQL Server

Interview priority: Focus particularly on questions 1, 4, 5, 6, 7, 8, 11, 12, 13, 14, 16, 17, 19, 20, 21, and 22.

For an Angular + ASP.NET Core Full Stack Developer interview, the most important practical topics are JWT authentication, functional HTTP interceptors, route guards, refresh-token rotation, role-based authorization, and secure token storage.