I need to jot down debugging steps for below scenario : "You are hosting a web app in your server which is accessible only to a particular set of people. But on an unusual day, all the people are able to access your web app. How would you troubleshoot this issue?"

I can make some assumptions for example : 1. Auth API might be down. 2. Auth API returning incorrect response for unauthorized users. 3. Web app not maintaining session based on auth API response.

What all other debugging steps should we perform on this scenario ?

  • 1 - What do you mean by "debugging steps"? Possible scenarios? 2 - What were the results of the investigation of the three hypotheses you raised? – João Farias Sep 27 '19 at 5:57

Clearly an interview question.
I will give you some pointers. You will need to both investigate and expand on them.

  • App change
  • Hacker change
  • Network changes
  • Webserver date issue
  • Security rule changes
  • Timezone/DST issues
  • Leap Year calculation issue
  • Authentication change in app
  • Existing bug in authentication
  • Year start/end Date Boundary
  • External provider authentication broken
  • It is after 03:14:07 UTC on 19 January 2038
  • Natural Disaster causing failover to unsecure setup
| improve this answer | |

Do you mean testing steps? A reasonable answer would depend on your environment. Are all users on the network or can users outside of the domain reach the app? Is this an active directory permission issue? I would check the web server activity log to see if any obscure event occured.

Usually it's the opposite that occurs, people who usually have access to an app all of the sudden cannot. In that case I check the app pool, see if it needs restarted. Is this hypothetical or can you give us more information about the environment?

| improve this answer | |

Any debug (especially if the application has been already deployed) should start from log analysis. I would analyze the logs for the day where the application was available for everyone. There might be exceptions or messages which could give you a clue. When I say "log" I mean all logs, not only application log, but system logs as well.

For example routing logs might show that packets are routed to authentication server that is running in dev mode, load balancer logs might show some unusual traffic for that day

I would also analyze any scheduled jobs (like cron). There might be activities that impacts application availability

Finally (if I could )I would snapshot the system for that day and replicate that in some virtual environment where I could manipulate with the system time. That would let dev guys to remotely connect to the system with their debuggers and watch internal state of the app more closely.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.