Web Security Middle interview questions and answers

75 questions for a Web Security (Middle) interview - with correct answers, explanations and links to the docs.

Take this quiz
  1. 1.A value is HTML-escaped and then placed into an inline script: <script>var q = '{{value}}';</script>. Why is this still unsafe?
  2. 2.Which of these is a DOM XSS sink?
  3. 3.Which of these is a typical DOM XSS source?
  4. 4.Why is eval(userInput) or new Function(userInput) always dangerous?
  5. 5.Where does Vue's v-html stand in terms of XSS?
  6. 6.What does Angular's bypassSecurityTrustHtml() do?
  7. 7.Users can upload SVG avatars that are served from your main domain. What's the risk?
  8. 8.Your app renders user-written Markdown to HTML. What must happen before inserting the result into the page?
  9. 9.Why is "sanitize on input, store the clean version" less reliable than encoding on output?
  10. 10.What do Trusted Types add on top of normal XSS defenses?
  11. 11.An app writes a user's display name into an attribute without quotes: <div title={{name}}>. What makes this worse than a quoted attribute?
  12. 12.Server-rendered state is embedded like this: <script>window.__STATE__ = ${JSON.stringify(state)}</script>. What's the problem?
  13. 13.How does a nonce-based CSP work?
  14. 14.What is a hash-based CSP source like 'sha256-...'?
  15. 15.What does 'strict-dynamic' do in script-src?
  16. 16.Why is a CSP like script-src 'self' https://cdn.example.com https://www.google.com considered weak?
  17. 17.What does object-src 'none' protect against?
  18. 18.Why should a strict CSP include base-uri 'none' (or 'self')?
  19. 19.Which CSP directive limits where fetch, XHR and WebSocket connections can go?
  20. 20.Is a CSP set in a <meta http-equiv> tag the same as one in a response header?
  21. 21.In Next.js, how is a nonce-based CSP usually set up?
  22. 22.How do you collect CSP violation reports?
  23. 23.Does SameSite=Lax fully replace CSRF tokens?
  24. 24.What is the double-submit cookie pattern?
  25. 25.How can checking the Origin header help against CSRF?
  26. 26.What does the Sec-Fetch-Site request header tell the server?
  27. 27.An API accepts only Content-Type: application/json. Why does that make classic CSRF harder?
  28. 28.What is login CSRF?
  29. 29.An app authenticates API calls with an Authorization: Bearer header taken from memory, not cookies. Is CSRF a concern?
  30. 30.Why should CSRF tokens not be put in URLs (for example ?csrf=...)?
  31. 31.Why is reflecting any request Origin back in Access-Control-Allow-Origin with credentials dangerous?
  32. 32.A server allows any origin that ends with example.com. What's the flaw?
  33. 33.Why should Access-Control-Allow-Origin: null never be allowed with credentials?
  34. 34.When the response depends on the request Origin, which header should the server add?
  35. 35.What does Access-Control-Max-Age control?
  36. 36.By default, which response headers can front-end code read from a cross-origin response?
  37. 37.A fetch sends credentials: 'include' to another origin. What else is needed for the browser to expose the response?
  38. 38.Which request does NOT trigger a CORS preflight?
  39. 39.What are the three parts of a JWT?
  40. 40.Is the payload of a signed JWT (JWS) secret?
  41. 41.What must a server check when it receives a JWT?
  42. 42.What is the alg: none attack on JWTs?
  43. 43.Why are JWTs harder to revoke than server-side sessions?
  44. 44.What is refresh token rotation?
  45. 45.Why are access tokens usually short-lived (minutes) while refresh tokens live longer?
  46. 46.What does the __Host- cookie name prefix guarantee?
  47. 47.Which session timeouts are recommended?
  48. 48.Why should a user be asked for their password again before changing their email or password?
  49. 49.Which OAuth 2.0 flow is recommended for a single-page app today?
  50. 50.What problem does PKCE solve?
  51. 51.What is the state parameter in OAuth for?
  52. 52.Why must the authorization server match redirect_uri exactly against registered values?
  53. 53.What is the difference between an OIDC ID token and an OAuth access token?
  54. 54.What are OAuth scopes?
  55. 55.Why shouldn't a browser app hold an OAuth client secret?
  56. 56."Sign in with Google" returns an ID token to your backend. What must the backend check?
  57. 57.What is IDOR (insecure direct object reference)?
  58. 58.An admin button is hidden in the UI for regular users. Is that access control?
  59. 59.What is mass assignment?
  60. 60.What is the difference between RBAC and ABAC?
  61. 61.Why is "deny by default" the safer authorization policy?
  62. 62.A multi-tenant SaaS filters data by tenantId from the request body. What's the risk?
  63. 63.How do you prevent SQL injection?
  64. 64.What is NoSQL injection, for example in MongoDB?
  65. 65.Which Node.js call is most dangerous with user input?
  66. 66.What is prototype pollution?
  67. 67.How do you prevent path traversal in a file download endpoint?
  68. 68.What is server-side template injection?
  69. 69.What does X-Content-Type-Options: nosniff do?
  70. 70.What is the risk the Referrer-Policy header reduces?
  71. 71.What is Permissions-Policy used for?
  72. 72.What does adding a site to the HSTS preload list achieve?
  73. 73.What does Cross-Origin-Resource-Policy: same-origin do?
  74. 74.A login page redirects to ?next= after success. How can that be abused?
  75. 75.What must a message event handler for postMessage check?