DEV Community: Deepak Govindarajan

Understanding Authentication and Authorization

Deepak Govindarajan — Wed, 27 Oct 2021 03:17:05 +0000

Authentication

Authentication is a process of proving and recognizing user’s correct identity. Generally, it deals with an individual’s username, password, OTP verification, and some type of additional verifications.

Types of Authentication

Single-Factor Authentication (SFA)
Two-factor Authentication (2FA)
Multi-factor Authentication (MFA)
Token Authentication
Certificate-based Authentication
Biometric Authentication

Single Factor Authentication (SFA)

Single-Factor Authentication is a widely used form of authentication. An user’s identity can be verified using username and password or pass code or other simple codes.

Two Factor Authentication (2FA)

Like SFA, 2FA also uses username and password with an additional verification code that will be available on their owned device (mobile). This is an extra layer of protection to confirm their identity. For example, by enabling two factor authentication in Gmail, it will sent an OTP to confirm the user’s identity.

Multi-factor Authentication (MFA)

MFA requires more than one type of authentication such as single authentication factor including a biometric factor (finger print, facial recognition, retina recognition and so on) or an authenticator app. The code generated by the authenticator app is a temporary one which can be expired in a short time.

Token Authentication

A token is a material device such as dongle, card or RFID chip that is used to securely access the systems. It makes more difficult for a hacker to access an account as they have long credentials.

Certificate-based Authentication

Certificate-based Authentication uses digital certificates to identify the user’s identity. A digital certificate is an electronic document that contains the digital identity of a user including a public key, and the digital signature of a certification authority. Only the certification authority can provide the digital certificate to the user. User can login to their server using this digital certificate.

Biometrics Authentication

The most unique authentication method is biometric authentication as it authenticate with individual’s characteristics. This authentication process includes facial recognition, finger print, retina scan and so on.

Authorization

Authorization is the process of giving someone the ability to access a resource with certain actions.

Types of Authorization

API keys
Basic Auth
HMAC
OAuth 2.0

API keys

Generally, most of the API services uses an API key. API key is a long string which is attached with request header or request URL to identify the person who is making the API call. In some cases, the APIs provides both public key and private key. The public key can be included in a request and the private key can be used only in server to server communication.

Basic Auth

Basic Auth uses username:password that can be placed in the request header. To avoid public readability, the username and password can be encoded with Base64 encoding technique. Base64 is a encoding algorithm that allows you to transform any characters into an alphabet which consists of Latin letters, digits, plus, and slash.

For example,
Authorization: Basic aGVsbG8gd29ybGQ=

Basic auth uses HTTPS, the message content that can be encrypted within the HTTP transport protocal. When the API server receives the message, it decrypts the message and provides the requested data.

HMAC

HMAC stands for Hash-based Message Authorization Code and is a stronger type of authentication used in financial APIs. The secret key is available only for the sender and receiver. The sender can create an authentication message with the help of a hash function in combination with a secret key. The resulting value, referred to as a signature, is placed in the request header.

When the receiver (the API server) receives the request from the sender, it generates the same message that involves a hash function in combination with a secret key. If the message matches the signature in the request header, it accepts the request otherwise the request is rejected.

OAuth 2.0

OAuth 2.0 is the most popular method for authentication and authorization that relies on an authentication server to communicate with the API server to grant access. OAuth 2 provides authorization flows for web and desktop applications, as well as mobile devices. The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service. For example: Login with Google, Login with Facebook, Login with Github etc.,.

Interview Questions in Javascript & Node.js

Deepak Govindarajan — Sun, 24 Oct 2021 06:11:46 +0000

Javascript

JavaScript is a scripting or programming language. It is lightweight and most commonly used as a part of web pages, whose implementations allow client-side script to interact with the user and make dynamic pages. It is an interpreted programming language with object-oriented capabilities.

Node.js

Node.js is a platform built on Google Chrome's JavaScript Engine (V8 Engine) for easily building fast and scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

1. What is the difference between SetTimeout, setImmediate and process.nextTick?

Outwardly SetTimeout, setImmediate and process.nextTick are the functions that do the same thing. They execute the callback after the current event loop, but before anything else.

setTimeout:

sets a timer which executes a function or specified piece of code once the timer expires.

setImmediate:

It is used to break up long running operations and run a callback function immediately after the browser has completed other operations such as events and display updates.

process.nextTick:

A function passed to process.nextTick() is going to be executed on the current iteration of the event loop, after the current operation ends. This means it will always execute before setTimeout and setImmediate.

Example:

function run() {
  setTimeout(() => console.log(" I am setTimeout"), 0);
  setImmediate(() => console.log("I am setImmediate"));
  process.nextTick(() => console.log("I am nextTick"));
  console.log("I am current event loop");
}

run()

Output:

I am current event loop
I am nextTick
I am setTimeout
I am setImmediate

In this, callbacks are not executed in the same order.

In the above output the first one is "I am current event loop" and second one executed was process.nextTick, which puts its callback at the front of the event queue. It will execute after the code currently being executed but before I/O events or timers.

Next is "timeout". Since we passed setTimeout a timeout of 0, there is no additional enforced delay before its execution, and it is placed on into the timer queue during the next loop.

In the end, we have setImmediate which will be slower than setTimeout 0.

Generally event loop looks like this,

timers -> IO -> poll -> check ->close -> timers -> ...

Timers: callbacks from setInterval or setTimeout
IO callbacks: callbacks from I/O events
Poll: retrieve new I/O events
Check: callbacks from setImmediate execute here
Close: handle closed connections like sockets

2. Explain closures function?

Closures ability is to remember the variables and functions that are declared in its outer scope.

For Example:

function showBiodata(){
  var employee = {
    name:"Rayn Dahl", 
    age:45,
    role: "Senior Programmer"
  };

  return function(){
    console.table(employee);
  }
}

var initClosure = showBiodata(); // Returns a function

initClosure();

The function showBiodata() gets executed and returns a function which we assigned to the variable:

var initClosure = showBiodata();

The returned function is then executed when we invoke initClosure:

initClosure();

Output:

(index)	Values
name	'Rayn Dahl'
age	45
role	'Senior Programmer'

In showBiodata(), instead of destroying the value of employee after execution, saves the value in the memory for further reference. This is the reason why the returning function is able to use the variable declared in the outer scope even after the function is already executed.

This ability of a function to store a variable for further reference even after it is executed, is called Closure.

3. What is a Temporal Dead Zone?

Temporal Dead Zone occurs when we try to access a variable before it is initialized, while using let and const keyword

For Example,

name = "Rayn Dahl"; // Gives reference error
let name;


function showWelcome(){
  message = "Welcome!!!"; // Throws a reference error

  let message;
}
showWelcome();

In the code above, we are trying to access variables which have not been declared yet

4. What is the difference between Rest parameter and Spread operator?

Rest parameter:

Rest parameter allows a function to accept an indefinite number of arguments as an array,

For example,

function sum(...args){
  let total = 0
  args.forEach(item=>total+=item)
  return total
}

console.log(total(1,2)); //3
console.log(total(1,2,3)); //6
console.log(total(1,2,3,4)); //10

Spread operator

Spread operator allows iterables( arrays / objects / strings ) to be expanded into single arguments/elements. Also we can use this to merge two arrays

For example,

function sum(x, y, z) {
  return x + y + z;
}

const numbers = [1, 2, 3];
console.log(sum(...numbers)); // output: 6


let numberStore = [1, 2];
let newNumber = [3, 4];
numberStore = [...numberStore, ...newNumber];
console.log(numberStore) // output: [1,2,3,4]

5. What is the difference between Promise and Observable?

6. What is the output of the below program?

function runner(){
  for(var i = 0; i < 3; i++){
    setTimeout(()=> console.log(i),1000);
  }
}

runner()

Output:

3
3
3

Variable declared inside the for loop with var keyword which does not have block scope. So the variable i is incremented first and then checked.

7. Guess the output of below code?

Code 1:

console.log(0.1 + 0.2 === 0.3)
console.log(0.1 + 0.7 === 0.8)
console.log(0.1 + 0.2 - 0.2 === 0.1)
console.log(0.1 + 0.4 === 0.5)

Output:

false 
false
false
true

0.1 +0.2 is equal to 0.30000000000000004
0.1 + 0.7 is equal to 0.7999999999999999
0.1 + 0.2 - 0.2 is equal to 0.10000000000000003

Code 2:

function runner()
{
    return 
    {
        name: "Rayn Dahl"
    }
}

console.log(runner().name)

Output:

Uncaught TypeError: Cannot read properties of undefined

Program will never execute after return statement. To fix follow the below method

function runner(){
    return {
        name: "Rayn Dahl"
    }
}
console.log(runner().name)

Output:

Rayn Dahl

8. What is the output of the below program?

let name = "Rayn";

(function showName() {
    if (name === "Rayn") {
        let name = "Rayn Dahl";
        console.log(name);
    }
    console.log(name);
})();

Output:

Rayn Dahl
Rayn

Here showName is closure and it gets the name variable from the outer scope. The conditional has another local variable name which overwrites the outer name variable. So the first console.log displays value "Rayn Dahl". Where as the second console.log logs "Rayn" by capturing the name variable from outerscope.

9. What is the output of the below code?

function sum(a = 1, b = 1) {
  return a + b
}

sum(); 
sum(2, 3);
sum('');
sum(null, 2);
sum(undefined, null)

output:

sum() - Here no arguments passed so default value 1 is taken and returned as 1+1=2
sum(2,3) - In this we have two arguments 2, 3 and returned as 2+3=5
sum('') - Here the first argument is string and second argument is not defined so default value 1 taken. "" + 1 = 1 (string concatenation)
sum(null, 2) - First argument is null and second argument is 2. null + 2 = 2
sum(undefined, null) - Here the first argument is undefined so it take default value 1 and second argument is null. 1 + null = 1

10. What is the output of below programs?

Code 1

let a = 0;
let b = new Number(0);

if(!a) console.log("Hello world");
if (!b) console.log("Hello Nodejs");
else console.log("Hello Javscript");

Output:

Hello world
Hello JavaScript

0 is false and !0 is true so "Hello world" is logged.
new Number returns object, Objects is truthy so the above code block goes to else condition i.e., "Hello Javascript"

Code 2

let { fullname: name, age, dept: department = "CSE", designation: role = "developer" } = { fullname: "Rayn Dahl", age: 45, dept: "IT" };

console.log(name);
console.log(age);
console.log(department);
console.log(role)

Output:

Rayn Dahl
45
IT
developer

The object property follows below rules,
The object properties can be retrieved and assigned to a variable with a different name
The property assigned a default value when the retrieved value is undefined