The Securitor

What are the three parts of a JWT and what should never be stored in the payload?

Explain mutual TLS (mTLS). Why does a service mesh like Istio enforce it between services?

What is the difference between authentication and authorization? Give a concrete example.

What is envelope encryption and why do cloud KMS services use it?

How would you implement token revocation for JWT-based auth without a database lookup on every request?

Storing JWT secrets in application code or config files

Symptom: After a code repository leak, attackers forge valid JWTs and authenticate as any user.

Not validating JWT claims beyond the signature

Symptom: Expired tokens are accepted; tokens issued for one service are accepted by another.

Using symmetric encryption for data that needs authentication

Symptom: An attacker flips bits in encrypted ciphertext, and the modified data is silently decrypted and accepted by the application.

Implementing RBAC with permission checks only at the API layer

Symptom: A user accesses another user's data by crafting a direct database query via a different API endpoint that skips the permission check.

Using a single shared API key for all services

Symptom: Rotating a compromised key requires updating every service simultaneously; one compromised service exposes all services.

Authentication Tokens: JWT vs Opaque Tokens vs Session Cookies

The choice of token type determines where validation happens, what information is available without a database lookup, and how revocation works.