ORIGINAL COMPANY-CONTEXT PRACTICE
Preserve authorization across a restricted storefront
Original practice scenario: Design a hypothetical storefront for an age-restricted product. A cached page and a payment callback must not accidentally bypass the access decision.
Written for independent practice using company context; this is not a verified question from a company interview.
A REASONED APPROACH
Model answer.
Separate public presentation from server-enforced eligibility and purchase authorization. A successful earlier check is a scoped, expiring assertion rather than permanent permission attached to a browser.
Work through it
- Represent verification outcome with a server-issued session reference, expiration and intended scope, minimizing retained personal information.
- Revalidate authorization at protected actions and ensure caches do not serve personalized eligibility decisions to another session.
- Test session expiration, replayed callbacks, account changes and denied verification; record minimal audit evidence and give clear failure handling.
Tradeoffs to discuss
- Frequent revalidation strengthens freshness but adds latency and user friction; duration must follow the actual service's applicable requirements.
Common pitfalls
- Client-side hidden buttons do not enforce access.
- Do not invent a universal legal age or verification rule for the exercise.