← Bloomberg Interview Insights
Felt pretty comfortable here since REST API design is bread and butter.
Start by clarifying requirements and constraints (e.g., security, statelessness, token strategy) before diving into endpoint design. Then walk through each API with request/response shapes, status codes, and error handling, emphasizing consistency and security best practices. Finally, discuss trade-offs and how you would handle edge cases like token expiration or invalid credentials.
Pro tip: Demonstrate awareness of security best practices by using HTTPS, hashing passwords, and using short-lived tokens with refresh mechanisms. Also, mention idempotency for sign-out and how to handle concurrent sessions.
Ask about expected scale, security requirements, client types (web, mobile), and whether sessions should be stateful or stateless. This shows you think before coding.
Define POST /signup with request body containing email, password, and optional profile data. Response returns 201 Created with user ID and possibly a token. Handle errors like 400 for invalid input, 409 for duplicate email.
For sign-in, use POST /signin with credentials, returning 200 OK with an access token (and refresh token). For sign-out, use POST /signout with token, returning 204 No Content. Discuss token invalidation strategies.
Define GET /greeting with Authorization header. Return 200 OK with a JSON object containing the greeting message. Handle 401 Unauthorized if token is missing or invalid.
Outline consistent error response format (e.g., {error: {code, message}}), appropriate status codes (400, 401, 403, 404, 409, 500), and trade-offs like JWT vs. session tokens, token expiration, and refresh strategies.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Start by comparing stateful sessions and stateless JWTs in terms of scalability, revocation, and complexity, then recommend a hybrid approach based on requirements. Walk through the security layers—password hashing, TLS, CSRF, and XSS—showing how they complement the chosen authentication method. Emphasize defense-in-depth and practical trade-offs relevant to Bloomberg's high-security, low-latency environment.
Pro tip: Mention that JWTs should be short-lived and paired with refresh tokens stored in HttpOnly cookies to balance statelessness with revocation, and highlight that Bloomberg's strict security posture likely favors a hybrid model with server-side session invalidation for sensitive operations.
Discuss trade-offs: stateful sessions offer easy revocation and server-side control but require shared storage; stateless JWTs scale horizontally and reduce DB lookups but complicate revocation and can grow large.
Propose using short-lived JWTs for most API calls and stateful sessions for sensitive actions (e.g., trading, account changes), or use refresh tokens with server-side revocation lists.
Explain using adaptive hashing algorithms like bcrypt, scrypt, or Argon2 with per-user salts and appropriate work factors, and never storing plaintext or reversible encryption.
Mandate TLS 1.2+ with HSTS, secure and HttpOnly cookie flags, and SameSite attributes to mitigate CSRF and session hijacking.
For CSRF: use anti-CSRF tokens or SameSite cookies; for XSS: apply output encoding, Content Security Policy, and input validation, and avoid storing tokens in localStorage.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Start by defining the threat model: session hijacking via token theft, guessing, fixation, and replay. Then walk through the session lifecycle—generation, storage, transmission, rotation, and expiration—explaining how each control (entropy, HttpOnly/Secure cookies, rotation, timeouts, binding) mitigates specific attacks. Conclude with trade-offs between security and usability, and mention additional defenses like TLS and CSRF protection.
Pro tip: Emphasize that session security is defense-in-depth: no single control is sufficient. Mention that you would combine high-entropy tokens, secure cookie attributes, rotation on privilege change, and server-side validation to make impersonation impractical.
Identify the main risks: session guessing, theft, fixation, and replay. This sets the context for why each control is necessary.
Use a cryptographically secure random number generator with at least 128 bits of entropy to make guessing infeasible.
Store session IDs in HttpOnly, Secure, SameSite cookies to prevent XSS theft and CSRF. Avoid URL or local storage. Always use TLS.
Rotate the session ID after login and privilege changes to prevent fixation. Set idle and absolute timeouts to limit the window for replay.
Bind sessions to client attributes (e.g., IP, user agent) and validate on each request. Use server-side revocation and monitor for anomalies.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Start by clarifying requirements and defining 'active' with specific signals and time window. Then design a scalable data pipeline and computation layer, and finally discuss capacity planning and trade-offs.
Pro tip: Emphasize the importance of defining 'active' in collaboration with product stakeholders and consider using approximate algorithms like Count-Min Sketch for efficiency at scale.
Ask questions to understand the scale, latency, and accuracy needs. Define 'active' based on product context, e.g., a user who performs at least one action (login, trade, view) within the time window.
List the events that count as activity (e.g., logins, trades, page views) and their sources (application logs, message queues). Consider weighting signals if some actions are more meaningful.
Choose a schema to store user activity events with timestamps. Use a time-series database or a distributed store like Cassandra for high write throughput, and consider pre-aggregation for efficiency.
Use a streaming or batch approach: for real-time, maintain a sliding window with a priority queue or use approximate algorithms (e.g., Count-Min Sketch) to handle high cardinality. For batch, use MapReduce or Spark to aggregate counts per user and then sort.
Estimate data volume (events per second, storage per day), compute resources needed, and design for horizontal scaling. Discuss partitioning, replication, and caching to meet latency and throughput requirements.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.