85 Security interview questions with detailed answers, sorted from basic to advanced. Free to practice, with progress saved automatically.
Application security is about authenticating the right users, authorizing them within the right scope, and defending code, data and infrastructure against attacks. The questions cover authentication and sessions, OAuth, authorization, XSS and other vulnerabilities, security headers and CSP, password storage with salt and pepper, rate limiting, secrets, and supply chain risk.
and 43 more topics.
XSS is a vulnerability that lets an attacker inject malicious scripts that run in the victim's browser — stealing sessions, redirecting users, modifying page content. - Stored XSS — the script is saved in the DB (comment, profile) and attacks every user who views the…
CSRF exploits the browser automatically attaching cookies to requests sent to a domain — the attacker plants a form/img on evil.com pointing at bank.com, and the request carries the victim's session cookie. - Example — <img src='https://bank.com/transfer?to=attacker&amount=1000': if the user is logged in and the…
OAuth 2.0 lets an app (the client) access a user's data at another service, for example reading a Google calendar, without ever knowing the user's password. It solves authorization, not authentication. To learn who the user is, use OpenID Connect (OIDC), an extension on top…
HTTPS is HTTP over TLS. TLS does three things: it encrypts data so anyone eavesdropping on the path cannot read it, it authenticates the server so you know you are talking to the right site, and it guarantees integrity so tampering in transit is detected.…
The same-origin policy (SOP) blocks JavaScript from one origin (scheme + host + port) from reading responses from another origin — so a malicious page cannot read another site's data using the user's login cookies. Note: SOP does not block SENDING cross-site requests — which…
Security headers are response headers that control browser behavior to block attacks — Helmet.js (app.use(helmet())) sets a sensible default set. - Content-Security-Policy — the most important header against XSS: it limits which sources may load and run scripts. Helmet enables a default policy, but you…
SQL injection injects SQL through user input to manipulate queries — bypassing login, extracting or deleting data. What it is - Classic example — a username of ' OR '1'='1' -- turns a string-concatenated query into SELECT FROM users WHERE username = '' OR '1'='1'…
Three cookie attributes decide whether JS can read the cookie (HttpOnly), which channel it travels over (Secure), and when it is sent cross-site (SameSite). A typical session cookie looks like this: - HttpOnly: JS cannot read the cookie through document.cookie. If the page has an…
A JWT (JSON Web Token) is a string with three parts: a header, a payload with user data (id, role, expiry) and a signature made with the server's secret. The server stores no session: it receives the token, checks the signature, and knows the token…
The OWASP Top 10 is a list of the 10 most common web security risk categories, compiled by OWASP from many companies' testing data plus a community survey and updated every few years. The latest edition is 2025; many articles and interview questions still use…
Both bcrypt and Argon2 are password hashing functions built to be slow — the opposite of SHA-256/MD5, which are optimized for speed. bcrypt: battle-tested since 1999, with difficulty set by a cost factor (saltRounds) that scales exponentially — bcrypt.hash(password, 12). Argon2: winner of the 2015…
Rate limiting prevents abuse, brute-force and DoS. Four common algorithms: Fixed window counts requests inside a fixed slot (0:00-0:59, 1:00-1:59). Easy to build, easy to game: 100 requests at the end of one window plus 100 at the start of the next is 200 requests…
Clickjacking is an attack that embeds your page in a transparent iframe on the attacker's page. Users think they are clicking a button on that page, but the click actually lands on your page, where they are already logged in. Example: evil.com embeds bank.com in…
SSO (Single Sign-On): log in once at a central identity provider (IdP), then access many applications (SP/relying party) without logging in again. Apps never hold the password; they trust a signed assertion from the IdP. Benefits: one place to manage accounts/MFA, centralized access revocation, fewer…
Authentication (authn) verifies who you are; authorization (authz) decides what you are allowed to do — authn always happens before authz. - Authentication — identity verification: logging in with a password, OTP, biometrics, OAuth/SSO. Result: the system knows which user the request comes from. -…
Hashing is one-way (irreversible), encryption is reversible with a key, encoding is reversible without any key — using the wrong one is a classic security mistake. - Hashing — turns input into a fixed-length string that cannot be reversed: password storage (bcrypt/argon2), file integrity checksums.…
A JWT has three dot-separated parts header.payload.signature, each base64url-encoded — base64url is encoding, not encryption: anyone holding the token can read the payload. - Structure — header ({ "alg": "RS256", "typ": "JWT" } — the signing algorithm); payload (claims: sub, exp, iss, aud...); signature over…
Core idea: the browser only ever holds a short-lived authorization code, while the access token is exchanged over a back-channel so it never appears in the address bar. Steps: 1. The app redirects the user to the provider's authorization endpoint with clientid, redirecturi, scope, state,…
PKCE (Proof Key for Code Exchange) prevents authorization code interception — where an attacker captures the code during the redirect (a mobile app registering the same custom URL scheme, browser logs, extensions...) and redeems it for a token. How it works: 1. The client generates…
The two tokens serve different purposes: idtoken accesstoken --------- Answers Who the user is (authentication) What the bearer may do (authorization) Audience (aud) The client app itself The resource server / API Format Always a signed JWT Provider's choice — may be opaque The idtoken…
state prevents CSRF on the callback step. Without it, an attacker can obtain an authorization code for their own account and trick the victim into opening that callback URL — linking the victim's account to the attacker's provider account, or leaving the victim acting under…
You need something server-side that distinguishes tokens issued before and after the revocation point. Three common approaches: 1. A tokenversion column on the user — the simplest. Access tokens carry a ver claim; middleware compares token.ver with user.tokenversion. Logging out everywhere is update users set…
A well-formed session cookie: - HttpOnly — JavaScript cannot read it via document.cookie. This is the main barrier under XSS. - Secure — sent over HTTPS only. Mandatory in production. - SameSite — controls whether the cookie rides along on cross-site requests: - Strict: never…
Do not simply extend the lifetime of the normal session cookie. The standard approach uses two tokens: - Session cookie — short-lived (tens of minutes to hours), used for every request. - Remember-me token — long-lived (14–30 days), used once to re-create a session after…
There is no user here, so the authorization code flow does not apply. Two common options: Client credentials grant — the service obtains a token using its own identity. The result is a service access token whose sub is not a user. Pros: reuses existing…
The core difference: an API key identifies an application/customer and lives a long time; an access token proves a granted permission and expires quickly. API key Access token --------- Lifetime Months/years, until manually revoked Minutes to hours Contents Random string, carries no information Claims (sub,…
The main flow: 1. The user enters a phone number → the server normalizes it to E.164 (+84...) so the same number is not stored two ways. 2. Generate a 6-digit OTP with a CSPRNG, store its hash with expiresat (3–5 minutes) and attempts =…
Use a dedicated, deliberately slow password hashing function: Argon2id (the first recommendation), or bcrypt/scrypt where Argon2 is unavailable. Never invent your own scheme. Why not SHA-256: it is designed to be fast. GPUs compute SHA-256 at billions of hashes per second, so once a database…
All three inject script into the page; they differ in where the payload travels and where the HTML is assembled. - Reflected: the payload rides in the request (query string, form) and the server concatenates it into the response HTML, e.g. res.send("<h1Not found: " +…
Both parse a string into real HTML and attach it to the DOM. Every tag and event attribute in that string becomes live. React escapes by default when you render {value}, so dangerouslySetInnerHTML is exactly where you switch that protection off — the verbose prop…
Because the browser parses each position in the page with different rules. A string escaped correctly for HTML body text can still break out elsewhere. Four contexts to remember: Position What to do ------ HTML body <divHERE</div Escape < & " ' Attribute value <div…
An open redirect is when the app takes a destination URL from user input and redirects there without validation. After login the user lands on a lookalike page. Because the link starts with your real domain, they trust it. Why it is worse than it…
CSP is the second line of defence after escaping: even if a payload reaches the DOM, the browser refuses to execute scripts that are not allowed. The problem with SSR frameworks is that pages always contain inline scripts (hydration data, Next's <Script). Allowing script-src 'unsafe-inline'…
Domain whitelists fail because you trust an entire origin, and that origin may host files that neutralise your CSP. Three classic bypasses: 1. A JSONP endpoint on a whitelisted domain: <script src="//cdn.example.com/jsonp?callback=alert(1)" — the script runs from an allowed origin. 2. A copy of a…
Yes, still needed. The premise is only partly true: only Chromium-based browsers default to Lax. And even with Lax, it shrinks the attack surface but is not a complete barrier. Layer 1 — SameSite cookies. Lax withholds cookies on cross-site requests except top-level GET navigations.…
These are textbook SSRF features: the server fetches a user-controlled URL while sitting inside the internal network. What attackers aim at: http://169.254.169.254/ (cloud metadata, yielding IAM credentials), http://localhost:port (admin panels, unauthenticated Redis/Elasticsearch), private ranges 10.x, 172.16-31.x, 192.168.x, and exotic schemes file://, gopher://, dict://. Layered design:…
Three questions to answer: is the file really that type, where is it stored, and how is it served back. 1. Verify the real type; do not trust the client. - The extension and Content-Type sent by the client are both forgeable. evil.php renamed to…
Path traversal happens when a user-supplied filename or path is concatenated into a file read/write. Why stripping ../ is not enough: - Single-pass stripping: ....// becomes ../ after one removal. - Encoding variants: %2e%2e%2f, double-encoded %252e%252e%252f, overlong UTF-8, Windows backslash ..\. - An absolute path…
CORS is a mechanism for relaxing the Same-Origin Policy. Misconfiguring it means handing your data to other sites. The most dangerous mistake — reflecting Origin together with credentials: Any site can now send a request carrying the victim's session cookie and read the response. It…
A salt is a random string, unique per password record, mixed in before hashing and stored in the clear next to the hash. Why every user needs a distinct salt: - Two users with the same password produce different hashes → the database no longer…
Brute force tries many passwords against one account: same username, thousands of candidate strings. Credential stuffing replays email/password pairs leaked from other sites against your system — each account may be tried exactly once, but across millions of accounts. What this means for defence: Brute…
NIST SP 800-63B (rev 4, finalised August 2025) reverses several legacy rules because they lowered real-world security instead of raising it. Do: - Minimum length of 15 when the password is the only authentication factor; only when it is used with MFA may the minimum…
User enumeration is an attacker determining which emails/usernames exist in your system. A list of real accounts makes credential stuffing and phishing far more effective. Three common leak channels: 1. Different message text — "No such email" vs "Wrong password". Return one generic message: "Email…
All three are slow hashes with a tunable cost, differing in the resource they force an attacker to spend. - Argon2id — the default choice for new systems. It is both CPU-hard and memory-hard, which removes the GPU/ASIC advantage; the id variant combines Argon2i's side-channel…
Old hashes cannot be "decrypted", but there are two upgrade strategies that require nothing from users. Option 1 — upgrade on login (lazy rehash). Keep the old hashes, add a column recording the algorithm. On a successful login you hold the plaintext password in memory…
Hard-locking an account after N failures creates a denial-of-service channel: an attacker only needs the victim's email, sends N wrong-password requests, and the person is locked out. With an email list harvested via enumeration they can lock accounts in bulk, including an admin account precisely…
Both — each direction blocks a different attack, and using only one leaves a gap. Counter key Blocks Blind spot --------- Per account Guessing one account from a multi-IP botnet Thinly spread credential stuffing (one try per account) Per IP Scripted guessing from a single…
TOTP (RFC 6238) is HOTP whose counter comes from time. Server and authenticator app share a random secret (base32-encoded, usually transferred via QR code). The 6-digit code is computed as: Nothing else is exchanged — the device works fully offline, which is why TOTP is…
The standard flow: the user submits their email → the server emails a link containing a single-use, short-lived token → the user opens it and sets a new password → the token is destroyed. Token requirements: - Generated by a CSPRNG with at least 128…
Authorization must be enforced server-side, as close to the data as possible, on every endpoint — the UI only decides what is displayed. Hiding the "Delete" button merely stops ordinary users from seeing the feature. An attacker does not use your UI: they open DevTools,…
Because git keeps history forever: once a secret lands in a commit, it stays there even if a later commit deletes the file. A private repo is not protection either — one flip to public, one fork, or one clone left on a former employee's…
They defend two different threats and do not substitute for each other. - In transit: protects data while it moves — browser to server, service to service, app to database. The mechanism is TLS (HTTPS, sslmode=require for Postgres). It stops eavesdropping and on-path tampering. -…
One question decides it: do you ever need the original value back? - Hashing — one-way, not reversible. Use it when you only need to compare or verify integrity: passwords, file checksums, cache keys. - Encryption — two-way, with a key to decrypt. Use it…
Rule one: rotate first, clean history later. Many people do the reverse — spending hours rewriting git history while the key is still live and bots have been scraping it since minutes after the push. Order of operations: 1. Treat it as fully compromised. Private…
No. Reading audit output as "make the number smaller" leads to two failures: blind upgrades that break the build, or ignoring the whole list as "all false positives". A sensible process: 1. Triage by real exposure. A vulnerability in devDependencies (build tools, test runners) never…
Data minimization means collecting and storing only what the stated purpose requires, and keeping it only as long as it is still needed. It is an architectural choice, not just a legal-team concern: data you never stored cannot leak. Concrete developer work: - Drop unused…
A SIEM (Security Information and Event Management) collects logs from every source in an organization into one place, normalizes them, runs correlation rules to detect signs of attack, and raises alerts for the SOC team. A single log line rarely means much; a SIEM is…
DevSecOps means building security into every step of the DevOps process and automating it in CI/CD, instead of waiting until the end for the security team to pentest before release day. The "shift left" idea: a security bug found at commit time is far cheaper…
Design it in layers, each assuming the previous one can be bypassed: passwords leak, SMS can be hijacked by SIM swap, tokens can be stolen. For a bank, authentication does not stop at login; each sensitive transaction is authenticated again. 1. Passwords: store with a…
