How does a Spring backend authenticate requests from a mobile app, and how do you make sure users only see their own data?
BackendMid-level
In shortThe app logs in with OAuth2 authorization code + PKCE and sends a short-lived JWT access token; Spring Security validates it as a resource server (signature, expiry, issuer, audience). Authorization is a separate check on every object, scoping queries to the caller to prevent IDOR.
Model answer
Authentication answers who is calling. The app opens the login page of an identity provider in the system browser (authorization code flow with PKCE), gets an authorization code, and exchanges it for a short-lived access token (a JWT, minutes) and a refresh token (stored in the Keychain or Keystore). Every API call sends Authorization: Bearer <token>.
The backend is an OAuth2 resource server: Spring Security verifies the signature with the issuer’s public keys and checks expiry, issuer and audience. No valid token means 401.
Authorization answers what they may do, at two levels:
- Per endpoint: scopes or roles (
hasAuthority("SCOPE_orders:write")). A known user without permission gets 403. - Per object: a valid token for customer A must not read customer B’s order. Scope every query to the caller,
findByIdAndCustomerId(id, jwt.getSubject()), and return 404 for objects that aren’t theirs. Skipping this is IDOR, the most common API vulnerability.
Trade-offs worth mentioning: a JWT can’t be revoked before it expires, so keep access tokens short, revoke refresh tokens on logout, and rotate them on use.
What they're looking for
The difference between authentication (who) and authorization (what they may do), JWT validation beyond the signature, 401 vs 403, short access tokens with refresh tokens, and object-level checks in the query, not only role checks on URLs.
Common mistakes
- Treating "has a valid token" as "may access this order".
- Believing logout invalidates an issued JWT.
- Storing secrets or personal data in the JWT payload, which anyone can read.
- Using the password grant or a client secret inside the app.
More backend questions
- What is the N+1 query problem, and how do you find and fix it?Mid-level
- What does Spring Boot's auto-configuration do, and how do you change what it set up?Mid-level
- Your Spring Boot service in Kubernetes keeps restarting with exit code 137. How do you investigate and fix it?Senior
- A Java service's p99 latency spikes every few minutes. How do you find the cause?Senior