Interview Q19: Why is conversation persistence a security concern?
Conversation IDs are not authorization. Every read/write must verify user or tenant ownership, and concurrent updates may need version checks or ordering controls.
Interview structure: define the concept, explain the design trade-off, and give one production example.
Note
Interview approach: explain the concept, show the control boundary, and discuss the failure mode.
Minimal illustration
// Example: validate a boundary before doing work.
function requireNonEmptyString(value) {
if (typeof value !== "string" || value.trim() === "") {
throw new Error("Expected a non-empty string");
}
return value;
}💡 The snippet demonstrates a general boundary-validation principle. Adapt the example to the concept and explain how the application enforces the rule at runtime.
Key Takeaways
- State the concept clearly.
- Mention one limitation or failure mode.
- Connect it to a production decision.
Knowledge Check
What should a server do with a client-supplied conversation ID?