Web Security Senior interview questions and answers

75 questions for a Web Security (Senior) interview - with correct answers, explanations and links to the docs.

Take this quiz
  1. 1.What does the STRIDE model help you do?
  2. 2.When is threat modeling most useful?
  3. 3.What is the core idea of zero trust architecture?
  4. 4.What is OWASP ASVS used for?
  5. 5.Why are secure defaults important in a shared internal library or framework?
  6. 6.A team adds a new data flow: the browser uploads files that a background worker processes. Which question is most important for the threat model?
  7. 7.What does "blast radius" mean in security design?
  8. 8.How do you roll out Trusted Types in a large existing app?
  9. 9.What is a script gadget?
  10. 10.What is mutation XSS (mXSS)?
  11. 11.What does the HTML Sanitizer API (setHTML) offer compared with a JavaScript sanitizer library?
  12. 12.What is dangling markup injection?
  13. 13.A policy uses a nonce, but the HTML page is cached by a CDN and served to many users. What's wrong?
  14. 14.Why can a CSP allowing https://cdn.jsdelivr.net be bypassed?
  15. 15.What does require-trusted-types-for 'script' actually enforce?
  16. 16.In a design system, a <RichText html={...} /> component wraps dangerouslySetInnerHTML. What's the most robust approach?
  17. 17.Why can XSS through postMessage happen even on a site with strict CSP?
  18. 18.What is a good way to handle CSP violation reports at scale?
  19. 19.Which is the main remaining risk once a strict nonce CSP and Trusted Types are in place?
  20. 20.Which two headers make a page cross-origin isolated?
  21. 21.Why were SharedArrayBuffer and high-resolution timers restricted after Spectre?
  22. 22.What does Cross-Origin-Opener-Policy: same-origin protect against?
  23. 23.What are XS-Leaks?
  24. 24.What does a resource isolation policy based on Fetch Metadata do?
  25. 25.What is site isolation in browsers?
  26. 26.What does Cross-Origin-Embedder-Policy: credentialless change compared with require-corp?
  27. 27.What attributes should an iframe that shows untrusted user HTML have?
  28. 28.Why do security teams serve user-uploaded content from a separate domain like usercontent.example?
  29. 29.What is the backend-for-frontend (BFF) pattern for SPA authentication?
  30. 30.Tokens kept only in memory in a SPA vs HttpOnly cookies: what's the key trade-off?
  31. 31.What is refresh token reuse detection?
  32. 32.What do sender-constrained tokens (for example DPoP) protect against?
  33. 33.What is the JWT algorithm confusion attack (RS256 to HS256)?
  34. 34.How are JWT signing keys rotated without logging everyone out?
  35. 35.Why are passkeys (WebAuthn) resistant to phishing?
  36. 36.Why is SMS considered a weaker second factor?
  37. 37.Which signals justify step-up authentication in the middle of a session?
  38. 38.How should "log out everywhere" be implemented with JWT access tokens?
  39. 39.Why should login and password reset responses take about the same time for existing and unknown accounts?
  40. 40.How should a service compare a provided API key or HMAC signature with the expected value?
  41. 41.Which source of randomness should be used for session IDs and reset tokens in a browser or Node.js?
  42. 42.According to the OAuth 2.0 Security BCP (RFC 9700), who should use PKCE?
  43. 43.What is an OAuth mix-up attack?
  44. 44.How can an authorization code or token leak through the Referer header?
  45. 45.What does the OIDC nonce parameter protect against?
  46. 46.Why should API access tokens have a specific audience (aud)?
  47. 47.Why does the OAuth BCP discourage the resource owner password credentials grant?
  48. 48.An OAuth provider allows redirect_uri=https://app.com/callback/../open-redirect?to=evil. What combination creates a token leak?
  49. 49.What is dependency confusion?
  50. 50.Why are npm postinstall scripts a supply chain risk?
  51. 51.What does npm package provenance give you?
  52. 52.What is SLSA?
  53. 53.A script from a CDN is included with <script src="https://cdn.example/lib@3.2.1.js">. What does adding integrity="sha384-..." protect against?
  54. 54.What's the main risk of loading many third-party scripts through a tag manager?
  55. 55.How should automated dependency updates (Dependabot, Renovate) be handled safely?
  56. 56.What is typosquatting in package registries?
  57. 57.Which CI practice best limits the damage of a compromised dependency during builds?
  58. 58.Your server fetches a URL that users provide for link previews. What's the biggest risk?
  59. 59.Why is unsafe deserialization dangerous?
  60. 60.What is ReDoS?
  61. 61.Which rate limiting design suits a public login API best?
  62. 62.What should never appear in application logs?
  63. 63.What is the main benefit of a secrets manager over environment variables in a repo?
  64. 64.Why should file uploads be validated by content and not just by extension?
  65. 65.What is BOLA in the OWASP API Security Top 10?
  66. 66.Why does every Next.js Server Action need its own authorization check?
  67. 67.What was the core issue in the 2025 Next.js middleware vulnerability (CVE-2025-29927)?
  68. 68.A React Server Component fetches a user record and passes the whole object to a Client Component. What's the risk?
  69. 69.Why can server-side rendering reintroduce XSS that the client framework would prevent?
  70. 70.An app sends user input to an LLM and shows the answer as HTML. Which risk does the OWASP LLM Top 10 list first?
  71. 71.Where should authorization logic live in a full-stack framework app to be the most reliable?
  72. 72.What does a CVSS score describe?
  73. 73.What is /.well-known/security.txt for?
  74. 74.What's the right order of actions when a production secret leaks?
  75. 75.How do automated scanning (SAST/DAST), pentests and bug bounties complement each other?