Web Security Junior interview questions and answers

75 questions for a Web Security (Junior) interview - with correct answers, explanations and links to the docs.

Take this quiz
  1. 1.What does the CIA triad in information security stand for?
  2. 2.A form checks in JavaScript that the age field is a number from 18 to 120. Is that enough to protect the server?
  3. 3.What is the OWASP Top 10?
  4. 4.What does the principle of least privilege mean?
  5. 5.What is defense in depth?
  6. 6.Why is "security through obscurity" (for example, a secret admin URL) not real protection?
  7. 7.What is a trust boundary?
  8. 8.Which data from the browser can the server trust without checking?
  9. 9.What does HTTPS protect?
  10. 10.An HTTPS page loads a script over plain http://. What happens in modern browsers?
  11. 11.What does the Strict-Transport-Security (HSTS) header do?
  12. 12.Why should a login form never be served over plain HTTP?
  13. 13.What does the padlock icon in the address bar guarantee?
  14. 14.What is a secure context in the browser?
  15. 15.Why do browsers show a full-page warning for an invalid or self-signed certificate?
  16. 16.What is cross-site scripting (XSS)?
  17. 17.What is stored XSS?
  18. 18.What is reflected XSS?
  19. 19.What is DOM-based XSS?
  20. 20.Which line safely shows a user's name in an element?
  21. 21.Why is rendering {comment.text} in JSX safe from XSS by default?
  22. 22.What risk does dangerouslySetInnerHTML bring in React?
  23. 23.Why can <a href={user.website}> in React still lead to XSS?
  24. 24.What does an HTML sanitizer such as DOMPurify do?
  25. 25.What is output encoding (escaping) in the context of XSS?
  26. 26.An attacker got XSS on your site. What can their script typically do?
  27. 27.Which approach to blocking XSS is the most reliable?
  28. 28.What is cross-site request forgery (CSRF)?
  29. 29.Why is CSRF possible with cookie-based sessions?
  30. 30.What is a CSRF token?
  31. 31.Why must a GET request never change data (for example GET /delete?id=5)?
  32. 32.What does SameSite=Lax on a session cookie do?
  33. 33.How is SameSite=Strict different from Lax?
  34. 34.Does a CSRF attacker see the response to the forged request?
  35. 35.Which attack does a CSRF token NOT protect against?
  36. 36.Which parts make up the origin of a URL?
  37. 37.Are https://app.example.com and https://api.example.com the same origin?
  38. 38.What does the same-origin policy stop?
  39. 39.What is CORS?
  40. 40.fetch('https://api.other.com/data') fails with a CORS error. Where is it fixed?
  41. 41.Does CORS protect your API from attackers using curl or a script on their own server?
  42. 42.What is a CORS preflight request?
  43. 43.Why can't a server respond with Access-Control-Allow-Origin: * together with Access-Control-Allow-Credentials: true?
  44. 44.What is the difference between CORS and CSRF?
  45. 45.What does the HttpOnly cookie attribute do?
  46. 46.What does the Secure cookie attribute do?
  47. 47.Which Set-Cookie line is the best choice for a session cookie?
  48. 48.Why is storing an access token in localStorage risky?
  49. 49.Which data should never be stored in localStorage?
  50. 50.What is a session ID, and what must it be like?
  51. 51.What should happen to the session when the user logs out?
  52. 52.Why should a new session ID be issued right after login?
  53. 53.What is the difference between authentication and authorization?
  54. 54.How should passwords be stored in a database?
  55. 55.What is a salt in password hashing?
  56. 56.Why should a login form say "Invalid email or password" instead of "This email doesn't exist"?
  57. 57.What is multi-factor authentication (MFA)?
  58. 58.What is credential stuffing?
  59. 59.Which measure helps most against brute-force login attempts?
  60. 60.What does modern guidance (for example NIST) say about password rules?
  61. 61.How should a "Forgot password" link work?
  62. 62.What is a passkey?
  63. 63.What is a Content Security Policy (CSP)?
  64. 64.With Content-Security-Policy: script-src 'self', what happens to <script>alert(1)</script> written into the page?
  65. 65.What does the default-src directive do?
  66. 66.What is Content-Security-Policy-Report-Only used for?
  67. 67.Why does adding 'unsafe-inline' to script-src weaken CSP so much?
  68. 68.What is clickjacking?
  69. 69.How do you stop other sites from framing your pages?
  70. 70.A React app needs a payment provider's secret API key. Where should it live?
  71. 71.In Next.js, which environment variables end up in the browser bundle?
  72. 72.You accidentally pushed a real API key to a public Git repository. What is the right first step?
  73. 73.What does npm audit do?
  74. 74.Why should the lockfile (package-lock.json) be committed and installed with npm ci in CI?
  75. 75.Why are detailed error messages with stack traces dangerous in production?