84 Security interview questions with answers (2026)

All Security interview questions

What is XSS (Cross-Site Scripting)? What are the types of XSS and how do you prevent them?

What is CSRF (Cross-Site Request Forgery)? How do you prevent it?

What is Content Security Policy (CSP)? How do you configure it?

What is OAuth 2.0? How does the Authorization Code flow work?

What are HTTPS and TLS? Why are they mandatory?

What is CORS? Why does the browser enforce the same-origin policy?

What are the important security headers in a web application?

What is SQL injection? How do you prevent it in Node.js?

What are cookie security attributes? What do HttpOnly, Secure, and SameSite do?

Dependency security: how do you manage vulnerabilities in npm packages?

What is the JWT authentication flow in Node.js?

What is the OWASP Top 10? What are its most critical risks?

JWT vs session-based authentication: when should you use each?

Password hashing: bcrypt vs argon2 — when should you use each?

Rate limiting strategies: Fixed window vs Sliding window vs Token bucket?

Secrets management: how do you securely manage secrets in production?

OAuth 2.0 security best practices: PKCE, state param, token storage?

What is clickjacking? How do X-Frame-Options and CSP frame-ancestors protect against it?

What is SSRF (Server-Side Request Forgery)? How do you prevent it?

What is Content Security Policy (CSP) and how does it help against XSS?

What is SSO? How do OIDC and SAML differ?

What is the difference between authentication and authorization?

How do hashing, encryption, and encoding differ? What is a salt?

What is the structure of a JWT? What are the common pitfalls when verifying JWTs?

What are the steps in the OAuth2 Authorization Code flow?

What attack does PKCE prevent? Why is the implicit flow no longer recommended?

In OpenID Connect, how does the `id_token` differ from the `access_token`? Can you call an API with the `id_token`?

What is the `state` parameter in OAuth2 for? How does it differ from OIDC's `nonce`?

What is the BFF (Backend-for-Frontend) pattern in authentication? Why is it recommended over letting the SPA hold tokens?

How do refresh token rotation and reuse detection work? Why do you need both?

How do you verify a JWT correctly? Name the classic mistakes people make when hand-rolling verification.

How do you implement "log out from all devices"? What should happen to old sessions when the password changes?

How would you design SSO across several different domains (not shared subdomains)?

Which attributes should a session cookie set? How do `SameSite`, `Secure`, `Domain`, and `Path` affect it?

How would you design a secure "remember me" feature?

In a multi-tenant system, how do you put scopes/claims into the token to enforce per-tenant authorization?

How do two internal services authenticate to each other? How do client credentials and mTLS differ?

How does an API key differ from an access token? When do you pick each, and how do you store API keys in the database?

How would you design a phone-number + OTP login flow?

How should passwords be stored in the database? Why not SHA-256?

How do reflected, stored, and DOM-based XSS differ? Which code produces each one?

Why are `innerHTML` and `dangerouslySetInnerHTML` dangerous? If you must render user HTML, how do you sanitize it properly?

Why is a single `escapeHtml()` helper not enough to stop XSS? What does context-aware escaping mean?

What is an open redirect? Why is it dangerous even though it "only" redirects, and how do you block it?

How would you write a CSP for a React/Next app? Why use a nonce instead of `unsafe-inline`?

Why are domain-whitelist CSPs (`script-src 'self' cdn.example.com`) usually bypassable? What does `strict-dynamic` solve?

With browsers defaulting to `SameSite=Lax`, do you still need CSRF tokens? Name three layers of defence and each one's gap.

Your app has an "import image from URL" feature and lets users enter webhook URLs. How do you design the SSRF defence?

The avatar upload accepts any file the user picks. How do you control it so malicious files cannot be uploaded?

When does path traversal happen? Why is filtering out `../` the wrong defence?

Which CORS misconfigurations turn it into a vulnerability? Why is "just reflect the Origin" dangerous?

What is prototype pollution in JavaScript? How does it lead to RCE or authorization bypass?

Your page embeds third-party analytics/chat scripts. What is the risk, and how far does Subresource Integrity help?

You sanitize HTML on the server, store it, and the client re-renders it. Where does that break? What is mXSS?

How do error messages and logs leak information? How would you design error reporting and logging safely?

Before shipping a new feature to production, what security checklist do you run through?

What is a salt and why must each user have their own? How does a pepper differ from a salt?

How does credential stuffing differ from brute force? Why do the defences differ too?

What does a modern password policy (NIST SP 800-63B) look like, and why drop periodic forced rotation?

What is user enumeration? How do login error messages and response timing leak it?

Between bcrypt, scrypt and Argon2id, which do you pick? What parameter values are reasonable?

A legacy system stores passwords as MD5/SHA-1. How do you migrate to bcrypt/Argon2 without forcing every user to reset?

Is locking an account after N failed logins safe? What is the reverse-DoS risk?

Should login rate limiting be keyed by IP or by account? How do you design it properly?

How does TOTP (Google Authenticator) work? How should backup codes be stored?

How do you design a secure forgot-password flow? What must a reset token satisfy?

Where should authorization checks live? Why is hiding a button not authorization?

What is IDOR/BOLA? How do you block it systemically instead of relying on developers to remember?

How do RBAC and ABAC differ? When does plain role-based access stop being enough?

How does mass assignment lead to privilege escalation? How do you block it thoroughly?

What is a timing attack on token comparison? Why is `===` unsafe and what replaces it?

How would you design logging and alerting for suspicious logins? How should users be notified?

Why should `.env` never be committed to git? Where do dev, CI, and production get their secrets instead?

What is the difference between encryption at rest and in transit? If we already have TLS, do we still need to encrypt data in the database?

When do you hash versus encrypt? Give an example of choosing wrong and its consequence.

What must never appear in application logs? How do you guarantee that across a large team?

You discover a production API key was committed to GitHub last week. In what order do you handle it?

`pnpm audit` reports 40 vulnerabilities, 5 of them critical. How do you handle it — is upgrading everything the answer?

What does data minimization mean? At the developer level, what do Vietnam's personal data protection law and GDPR actually require?

You must encrypt national ID numbers in the database yet still look records up by that number. How do you design it?

How dangerous are typosquatting and hijacked npm packages? Where do you block them?

How do you prove the artifact running in production was actually built from the source in your repo? What does SLSA address?

A researcher reports an actively exploitable IDOR on production. What is your order of operations?

Your team is about to build an internal wallet-to-wallet transfer feature. How do you run lightweight threat modeling and security review?

All Security interview questions

What is XSS (Cross-Site Scripting)? What are the types of XSS and how do you prevent them?
What is CSRF (Cross-Site Request Forgery)? How do you prevent it?
What is Content Security Policy (CSP)? How do you configure it?
What is OAuth 2.0? How does the Authorization Code flow work?
What are HTTPS and TLS? Why are they mandatory?
What is CORS? Why does the browser enforce the same-origin policy?
What are the important security headers in a web application?
What is SQL injection? How do you prevent it in Node.js?
What are cookie security attributes? What do HttpOnly, Secure, and SameSite do?
Dependency security: how do you manage vulnerabilities in npm packages?
What is the JWT authentication flow in Node.js?
What is the OWASP Top 10? What are its most critical risks?
JWT vs session-based authentication: when should you use each?
Password hashing: bcrypt vs argon2 — when should you use each?
Rate limiting strategies: Fixed window vs Sliding window vs Token bucket?
Secrets management: how do you securely manage secrets in production?
OAuth 2.0 security best practices: PKCE, state param, token storage?
What is clickjacking? How do X-Frame-Options and CSP frame-ancestors protect against it?
What is SSRF (Server-Side Request Forgery)? How do you prevent it?
What is Content Security Policy (CSP) and how does it help against XSS?
What is SSO? How do OIDC and SAML differ?
What is the difference between authentication and authorization?
How do hashing, encryption, and encoding differ? What is a salt?
What is the structure of a JWT? What are the common pitfalls when verifying JWTs?
What are the steps in the OAuth2 Authorization Code flow?
What attack does PKCE prevent? Why is the implicit flow no longer recommended?
In OpenID Connect, how does the `id_token` differ from the `access_token`? Can you call an API with the `id_token`?
What is the `state` parameter in OAuth2 for? How does it differ from OIDC's `nonce`?
What is the BFF (Backend-for-Frontend) pattern in authentication? Why is it recommended over letting the SPA hold tokens?
How do refresh token rotation and reuse detection work? Why do you need both?
How do you verify a JWT correctly? Name the classic mistakes people make when hand-rolling verification.
How do you implement "log out from all devices"? What should happen to old sessions when the password changes?
How would you design SSO across several different domains (not shared subdomains)?
Which attributes should a session cookie set? How do `SameSite`, `Secure`, `Domain`, and `Path` affect it?
How would you design a secure "remember me" feature?
In a multi-tenant system, how do you put scopes/claims into the token to enforce per-tenant authorization?
How do two internal services authenticate to each other? How do client credentials and mTLS differ?
How does an API key differ from an access token? When do you pick each, and how do you store API keys in the database?
How would you design a phone-number + OTP login flow?
How should passwords be stored in the database? Why not SHA-256?
How do reflected, stored, and DOM-based XSS differ? Which code produces each one?
Why are `innerHTML` and `dangerouslySetInnerHTML` dangerous? If you must render user HTML, how do you sanitize it properly?
Why is a single `escapeHtml()` helper not enough to stop XSS? What does context-aware escaping mean?
What is an open redirect? Why is it dangerous even though it "only" redirects, and how do you block it?
How would you write a CSP for a React/Next app? Why use a nonce instead of `unsafe-inline`?
Why are domain-whitelist CSPs (`script-src 'self' cdn.example.com`) usually bypassable? What does `strict-dynamic` solve?
With browsers defaulting to `SameSite=Lax`, do you still need CSRF tokens? Name three layers of defence and each one's gap.
Your app has an "import image from URL" feature and lets users enter webhook URLs. How do you design the SSRF defence?
The avatar upload accepts any file the user picks. How do you control it so malicious files cannot be uploaded?
When does path traversal happen? Why is filtering out `../` the wrong defence?
Which CORS misconfigurations turn it into a vulnerability? Why is "just reflect the Origin" dangerous?
What is prototype pollution in JavaScript? How does it lead to RCE or authorization bypass?
Your page embeds third-party analytics/chat scripts. What is the risk, and how far does Subresource Integrity help?
You sanitize HTML on the server, store it, and the client re-renders it. Where does that break? What is mXSS?
How do error messages and logs leak information? How would you design error reporting and logging safely?
Before shipping a new feature to production, what security checklist do you run through?
What is a salt and why must each user have their own? How does a pepper differ from a salt?
How does credential stuffing differ from brute force? Why do the defences differ too?
What does a modern password policy (NIST SP 800-63B) look like, and why drop periodic forced rotation?
What is user enumeration? How do login error messages and response timing leak it?
Between bcrypt, scrypt and Argon2id, which do you pick? What parameter values are reasonable?
A legacy system stores passwords as MD5/SHA-1. How do you migrate to bcrypt/Argon2 without forcing every user to reset?
Is locking an account after N failed logins safe? What is the reverse-DoS risk?
Should login rate limiting be keyed by IP or by account? How do you design it properly?
How does TOTP (Google Authenticator) work? How should backup codes be stored?
How do you design a secure forgot-password flow? What must a reset token satisfy?
Where should authorization checks live? Why is hiding a button not authorization?
What is IDOR/BOLA? How do you block it systemically instead of relying on developers to remember?
How do RBAC and ABAC differ? When does plain role-based access stop being enough?
How does mass assignment lead to privilege escalation? How do you block it thoroughly?
What is a timing attack on token comparison? Why is `===` unsafe and what replaces it?
How would you design logging and alerting for suspicious logins? How should users be notified?
Why should `.env` never be committed to git? Where do dev, CI, and production get their secrets instead?
What is the difference between encryption at rest and in transit? If we already have TLS, do we still need to encrypt data in the database?
When do you hash versus encrypt? Give an example of choosing wrong and its consequence.
What must never appear in application logs? How do you guarantee that across a large team?
You discover a production API key was committed to GitHub last week. In what order do you handle it?
`pnpm audit` reports 40 vulnerabilities, 5 of them critical. How do you handle it — is upgrading everything the answer?
What does data minimization mean? At the developer level, what do Vietnam's personal data protection law and GDPR actually require?
You must encrypt national ID numbers in the database yet still look records up by that number. How do you design it?
How dangerous are typosquatting and hijacked npm packages? Where do you block them?
How do you prove the artifact running in production was actually built from the source in your repo? What does SLSA address?
A researcher reports an actively exploitable IDOR on production. What is your order of operations?
Your team is about to build an internal wallet-to-wallet transfer feature. How do you run lightweight threat modeling and security review?