One Technical Screening Round - [On Phone]

Followed by a series of face-to-face technical rounds regarding technology, design approach, algorithm writing, architecture, and a few aptitude questions. There is no separate HR or negotiation round.

This was for the Oracle ADF team, wherein questions were mostly based on algorithms, complexity, and then inclined towards J2EE frameworks (mostly JSF).

The interviewers were very good, and I enjoyed the whole process. They released the offer letter after 40 days.

When you are developing a web portal that contains sensitive information, how should you maintain the session?

For my previous question, I suggested a combination of a server-side session object and using encoding to secure sensitive information. The interviewer then asked, "The session object also uses cookies or URL rewriting for maintaining state based on the client browser settings. How is that secure? You mentioned that cookies are on the client side, and URL rewriting has its own problems, like following any link to an outside application and then returning to the application, which will not have the encoded user state in the URL."