Authentication and authorization answer different questions

Authentication establishes who made a request. Authorization decides whether that identity can perform the requested action. A signed-in user is not automatically allowed to manage every resource.

Why cookies need an anti-forgery defense

Browsers attach cookies automatically. A malicious site may try to make a victim's browser send a state-changing request with its valid session cookie. SameSite cookies help reduce exposure, but sensitive cookie-authenticated mutations should also validate an anti-forgery token sent in a request header.

Keep protections on the server

A hidden button is a user-interface choice, not an access-control boundary. Apply the required authorization policy to the endpoint and validate the expected anti-forgery token on mutations. Use secure cookie attributes appropriate to the environment and do not put session credentials in URLs or logs.

Separate public and internal access

Public reading and anonymous quiz flows should not accidentally become dependent on internal session storage. Internal management routes should fail closed when session validation is unavailable. Error responses should not reveal passwords, tokens, or whether a particular account exists.

Interview takeaway

Trace a mutation from browser cookie to endpoint policy, CSRF validation, business authorization, and audit. Explain what remains protected if the user interface is bypassed.