← Microsoft Interview Insights
I started with interfaces and worked down, which felt right, but I fumbled when they pushed on how I'd handle shared behavior across classes that don't share a parent.
Start by clarifying the problem domain and requirements, then apply the Single Responsibility Principle to assign responsibilities to classes. Use interfaces to define contracts for behavior that may have multiple implementations or needs to be mocked, and concrete classes for specific implementations with state and logic.
Pro tip: Emphasize that interfaces should be designed from the client's perspective, focusing on what the client needs, not on how the implementation works. This shows you understand the Dependency Inversion Principle and API design.
Identify the core entities, their behaviors, and the interactions between them. Consider current and future needs to avoid over-engineering.
Use Single Responsibility to assign one reason to change per class, and Interface Segregation to keep interfaces focused. Favor composition over inheritance for flexibility.
Use interfaces to define contracts for behaviors that may vary or need multiple implementations. Use concrete classes for specific implementations with state and logic that are unlikely to change.
Start with concrete classes if unsure, and refactor to interfaces when patterns emerge. Validate design with unit tests and mockability.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Structure your answer as a narrative journey of a user authenticating, starting from the initial request and ending with authorized access. Compare and contrast cookies vs tokens and session vs stateless approaches, then explain OAuth/OIDC flows as a standardized way to delegate authentication. Emphasize trade-offs and real-world considerations like security and scalability.
Pro tip: Tie your explanation to Microsoft's ecosystem (e.g., Azure AD, MSAL) and highlight security best practices like token validation and secure cookie attributes to show practical maturity.
Describe how a user submits credentials (e.g., username/password) to the server, which verifies them against a user store.
Explain how the server creates a session and returns a session ID (stored in a cookie) or a token (e.g., JWT) to the client.
Detail how the browser automatically includes cookies or the client attaches tokens in headers for each request, and how the server validates them.
Introduce OAuth 2.0 for authorization and OIDC for authentication, explaining common flows like authorization code with PKCE and how tokens (access, ID, refresh) are used.
Compare cookies vs tokens (e.g., CSRF vs XSS, scalability) and discuss security measures like HTTPS, HttpOnly, SameSite, and token expiration.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Got into the XSS versus CSRF distinction and I think I had it right but I was second-guessing myself mid-answer.
Start by outlining the security risks of storing tokens in the browser, focusing on XSS and CSRF. Then explain how cookie attributes like HttpOnly, Secure, and SameSite mitigate these risks, and discuss trade-offs between different storage mechanisms.
Pro tip: Emphasize that while HttpOnly cookies prevent XSS token theft, they don't eliminate XSS entirely; combining with other defenses like CSP and input sanitization is crucial. Also, mention that SameSite helps with CSRF but consider its limitations with older browsers.
Discuss common storage locations: localStorage, sessionStorage, and cookies. Highlight that localStorage/sessionStorage are accessible via JavaScript, making them vulnerable to XSS.
Define XSS (malicious script injection) and CSRF (forced authenticated requests). Explain how tokens in JavaScript-accessible storage can be stolen via XSS, and how cookies are automatically sent, enabling CSRF.
Explain HttpOnly (prevents JavaScript access, mitigating XSS token theft), Secure (ensures transmission over HTTPS, preventing MITM), and SameSite (restricts cross-site sending, mitigating CSRF).
Compare cookie-based vs. token-based auth. Note that HttpOnly cookies are not immune to all XSS (e.g., CSRF via XSS), and SameSite may not cover all cases. Recommend layered security: CSP, CSRF tokens, and proper CORS.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.