Question 1

What is the Same-Origin Policy?

Accepted Answer

The Same-Origin Policy is a browser security mechanism that restricts how documents or scripts from one origin can interact with resources from another origin. Origins match when protocol, domain, and port are identical.

Question 2

What is CORS and why is it needed?

Accepted Answer

CORS (Cross-Origin Resource Sharing) is a mechanism that allows servers to specify which origins can access their resources. It relaxes the Same-Origin Policy through HTTP headers like Access-Control-Allow-Origin.

Question 3

What is Cross-Site Scripting (XSS)?

Accepted Answer

XSS is a vulnerability where attackers inject malicious scripts into web pages viewed by other users. There are three types: Stored XSS (persistent), Reflected XSS (non-persistent), and DOM-based XSS (client-side).

Question 4

How do you prevent XSS attacks?

Accepted Answer

Prevent XSS by encoding output based on context (HTML, JavaScript, URL), using Content Security Policy headers, validating and sanitizing input, and using frameworks with automatic escaping like React or Angular.

Question 5

What is Content Security Policy (CSP)?

Accepted Answer

CSP is an HTTP header that specifies which content sources are allowed on a page. It prevents XSS by blocking inline scripts and restricting script sources, with directives like script-src, style-src, and default-src.

Question 6

What is Cross-Site Request Forgery (CSRF)?

Accepted Answer

CSRF tricks authenticated users into submitting unwanted requests. Attackers create malicious pages that make requests to target sites, exploiting the browser's automatic cookie inclusion for authenticated sessions.

Question 7

How do CSRF tokens work?

Accepted Answer

CSRF tokens are unique, unpredictable values generated server-side and included in forms. The server validates tokens on submission—attackers cannot forge requests without knowing the victim's token value.

Question 8

What is the SameSite cookie attribute?

Accepted Answer

SameSite controls whether cookies are sent with cross-site requests. 'Strict' blocks all cross-site cookies, 'Lax' allows them for safe navigation, and 'None' allows all but requires the Secure attribute.

Question 9

What are JWT tokens and their security risks?

Accepted Answer

JWTs are self-contained tokens with encoded claims. Security risks include weak signing algorithms, sensitive data in payloads, no built-in revocation, and XSS exposure. Always use strong algorithms and short expiration.

Question 10

What is the difference between cookies and tokens for auth?

Accepted Answer

Cookies are automatically sent with requests and can use HttpOnly/Secure flags. Tokens (like JWTs) are stored in localStorage/memory and sent in headers. Cookies are vulnerable to CSRF; tokens to XSS.

Question 11

What is HTTPS and why is it important?

Accepted Answer

HTTPS encrypts communication between browser and server using TLS. It prevents eavesdropping, man-in-the-middle attacks, and data tampering. It's essential for protecting credentials, sessions, and sensitive data.

Question 12

What is HSTS (HTTP Strict Transport Security)?

Accepted Answer

HSTS is a header telling browsers to only connect via HTTPS. It prevents protocol downgrade attacks and cookie hijacking by forcing secure connections even when users type http:// URLs.

Question 13

What are secure cookie attributes?

Accepted Answer

HttpOnly prevents JavaScript access (XSS protection). Secure ensures cookies only sent over HTTPS. SameSite controls cross-site sending (CSRF protection). Use all three for session cookies.

Question 14

What is clickjacking and how do you prevent it?

Accepted Answer

Clickjacking tricks users into clicking hidden elements via transparent iframes. Prevent it with X-Frame-Options header (DENY or SAMEORIGIN) or CSP frame-ancestors directive to control embedding.

Question 15

What is Subresource Integrity (SRI)?

Accepted Answer

SRI verifies that external scripts and stylesheets haven't been tampered with using cryptographic hashes. Add integrity attribute with base64-encoded hash—browser blocks resources if hash doesn't match.

Web Security Fundamentals(4 questions)

What is the Same-Origin Policy and why is it important?

What is CORS and how does it work?

What is the difference between authentication and authorization?

What are security headers and which ones should every web application implement?

Cross-Site Scripting (XSS)(5 questions)

What is Cross-Site Scripting (XSS) and what are its types?

What is the difference between stored, reflected, and DOM-based XSS?

How do you prevent XSS attacks?

What is output encoding and how does it prevent XSS?

How does Content Security Policy (CSP) help prevent XSS?

Cross-Site Request Forgery (CSRF)(4 questions)

What is Cross-Site Request Forgery (CSRF)?

How do CSRF tokens work?

What is the SameSite cookie attribute and how does it prevent CSRF?

What is the difference between CSRF and XSS?

Authentication Security(5 questions)

What are JWT tokens and what security considerations apply to them?

What is the difference between cookies and tokens for authentication?

How do you securely implement "Remember Me" functionality?

What is OAuth 2.0 and what are its security considerations?

How do you implement secure password reset functionality?

Session Security(4 questions)

What are the security best practices for session management?

What are secure cookie attributes (HttpOnly, Secure, SameSite)?

How do you prevent session hijacking?

What is session timeout and why is it important?

HTTPS and Transport Security(4 questions)

Why is HTTPS important and how does it work?

What is HSTS (HTTP Strict Transport Security)?

What is certificate pinning and when would you use it?

How do you handle mixed content issues?

API Security(4 questions)

What are the security best practices for REST APIs?

How do you implement rate limiting and why is it important?

What is API key security and how do you protect API keys?

How do you validate and sanitize API input?

Client-Side Security(5 questions)

What are the security risks of storing sensitive data in localStorage?

How do you securely handle sensitive data in JavaScript?

What is clickjacking and how do you prevent it?

What are the security implications of third-party scripts?

How do you implement Subresource Integrity (SRI)?