[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"content:legacy:page:\u002Finterviews\u002Fweb-security":3,"content:legacy:navigation":239,"content:legacy:surround:\u002Finterviews\u002Fweb-security":567},{"id":4,"title":5,"body":6,"description":226,"extension":227,"icon":228,"meta":229,"modifiedAt":230,"navigation":231,"path":232,"publishedAt":233,"seo":234,"sitemap":235,"stem":236,"updatedAt":237,"__hash__":238},"interviews\u002Finterviews\u002Fweb-security.md","Web Security",{"type":7,"value":8,"toc":224},"minimark",[9,32,50,68,86,104,152,170,188,206],[10,11,12,23],"collapsible",{},[13,14,16],"template",{"v-slot:title":15},"",[17,18,19],"ol",{},[20,21,22],"li",{},"Authentication and authorization solve what different problems?",[13,24,25,29],{"v-slot:content":15},[26,27,28],"p",{},"Authentication establishes who or what a caller is. Authorization decides whether that identity may perform a specific action on a specific resource.",[26,30,31],{},"Authenticate once per trusted session as appropriate, but enforce authorization at every protected server operation. Hiding a button in the UI is not authorization.",[10,33,34,42],{},[13,35,36],{"v-slot:title":15},[17,37,39],{"start":38},2,[20,40,41],{},"How does cross-site scripting happen, and how is it prevented?",[13,43,44,47],{"v-slot:content":15},[26,45,46],{},"XSS occurs when attacker-controlled data is interpreted as executable browser content. Prevent it with context-aware output encoding, safe templating defaults, strict URL handling, and sanitization only when intentionally allowing HTML.",[26,48,49],{},"Avoid unsafe DOM sinks and inline script patterns. A well-designed Content Security Policy adds defense in depth but does not replace correct encoding.",[10,51,52,60],{},[13,53,54],{"v-slot:title":15},[17,55,57],{"start":56},3,[20,58,59],{},"What is CSRF, and when are anti-CSRF controls needed?",[13,61,62,65],{"v-slot:content":15},[26,63,64],{},"CSRF tricks a browser into sending an authenticated state-changing request to another site, usually because ambient credentials such as cookies are attached automatically.",[26,66,67],{},"Use suitable SameSite cookies, anti-CSRF tokens, and Origin or Referer validation. State-changing endpoints should not use GET. The exact controls depend on the authentication mechanism and browser flow.",[10,69,70,78],{},[13,71,72],{"v-slot:title":15},[17,73,75],{"start":74},4,[20,76,77],{},"How do parameterized queries prevent SQL injection?",[13,79,80,83],{"v-slot:content":15},[26,81,82],{},"They send query structure separately from values, so attacker input is treated as data instead of executable SQL syntax. Every dynamic value should use parameters supported by the driver.",[26,84,85],{},"Allow-list identifiers or sort directions that cannot be parameterized. An ORM reduces manual SQL but does not make raw fragments automatically safe.",[10,87,88,96],{},[13,89,90],{"v-slot:title":15},[17,91,93],{"start":92},5,[20,94,95],{},"How should passwords be stored?",[13,97,98,101],{"v-slot:content":15},[26,99,100],{},"Store a salted password hash produced by a password-specific, resource-intensive algorithm with parameters appropriate for the environment. Never store reversible encrypted passwords or fast general-purpose hashes.",[26,102,103],{},"Support rate limiting, breached-password checks where appropriate, secure reset flows, and parameter upgrades when users authenticate.",[10,105,106,114],{},[13,107,108],{"v-slot:title":15},[17,109,111],{"start":110},6,[20,112,113],{},"What cookie attributes protect a session?",[13,115,116,149],{"v-slot:content":15},[117,118,119,126,132,138],"ul",{},[20,120,121,125],{},[122,123,124],"code",{},"HttpOnly"," prevents JavaScript from reading the cookie.",[20,127,128,131],{},[122,129,130],{},"Secure"," restricts it to HTTPS.",[20,133,134,137],{},[122,135,136],{},"SameSite"," limits cross-site attachment according to the chosen mode.",[20,139,140,141,144,145,148],{},"Narrow ",[122,142,143],{},"Path"," and ",[122,146,147],{},"Domain"," reduce unnecessary exposure.",[26,150,151],{},"Also rotate session identifiers after privilege changes and expire or revoke sessions server-side.",[10,153,154,162],{},[13,155,156],{"v-slot:title":15},[17,157,159],{"start":158},7,[20,160,161],{},"What is SSRF?",[13,163,164,167],{"v-slot:content":15},[26,165,166],{},"Server-side request forgery occurs when an attacker influences a server to request unintended destinations, potentially reaching internal services or cloud metadata.",[26,168,169],{},"Use strict destination allow-lists, resolve and validate addresses carefully, restrict egress at the network layer, control redirects, and set response-size and timeout limits.",[10,171,172,180],{},[13,173,174],{"v-slot:title":15},[17,175,177],{"start":176},8,[20,178,179],{},"Why is mass assignment dangerous?",[13,181,182,185],{"v-slot:content":15},[26,183,184],{},"Binding an entire request body directly to a domain model can let callers set privileged fields such as role, owner, price, or approval status.",[26,186,187],{},"Define explicit input DTOs, allow-list writable fields per operation, validate them, and derive protected fields from trusted server context.",[10,189,190,198],{},[13,191,192],{"v-slot:title":15},[17,193,195],{"start":194},9,[20,196,197],{},"How should file uploads be secured?",[13,199,200,203],{"v-slot:content":15},[26,201,202],{},"Limit size and count, stream rather than buffering blindly, generate server-side names, store outside executable web roots, and validate the actual content instead of trusting extensions or client MIME types.",[26,204,205],{},"Apply authorization to upload and download, scan when the risk model requires it, and serve risky formats as attachments from an isolated origin.",[10,207,208,216],{},[13,209,210],{"v-slot:title":15},[17,211,213],{"start":212},10,[20,214,215],{},"What does least privilege mean in application architecture?",[13,217,218,221],{"v-slot:content":15},[26,219,220],{},"Each user, process, token, and service receives only the permissions and data access required for its current job. Separate roles and environments, scope credentials, and use short-lived identity where possible.",[26,222,223],{},"Least privilege reduces blast radius but needs audits, useful access logs, and a practical process for granting and removing access.",{"title":15,"searchDepth":38,"depth":38,"links":225},[],"Security interview questions about authentication, authorization, browser threats, secrets, and secure design.","md","lucide:shield-check",{},null,true,"\u002Finterviews\u002Fweb-security","2026-09-21",{"title":5,"description":226},{"loc":232,"lastmod":233},"interviews\u002Fweb-security","2026-09-21T22:49:35+07:00","bkSFl6_KexfB6PWIVK_MLgDHVwwGRu2jrXUGjwS_7tk",[240,391,499,514],{"title":241,"icon":242,"path":243,"stem":244,"children":245,"page":256},"Posts","fluent-color:data-bar-vertical-ascending-24","\u002Fposts","posts",[246,257,275,301,311,325,335,345,355,381],{"title":247,"icon":248,"redirect":249,"path":250,"stem":251,"children":252,"page":256},"Database","material-icon-theme:database","\u002Fposts\u002Fdatabase\u002Freplication-strategy","\u002Fposts\u002Fdatabase","posts\u002Fdatabase",[253],{"title":254,"path":249,"stem":255,"icon":230},"Database Replication strategy in large systems","posts\u002Fdatabase\u002Freplication-strategy",false,{"title":258,"icon":259,"redirect":260,"path":261,"stem":262,"children":263,"page":256},"Docker","vscode-icons:file-type-docker2","\u002Fposts\u002Fdocker\u002Fdocker-commands","\u002Fposts\u002Fdocker","posts\u002Fdocker",[264,267,271],{"title":265,"path":260,"stem":266,"icon":230},"Docker commands essentials","posts\u002Fdocker\u002Fdocker-commands",{"title":268,"path":269,"stem":270,"icon":230},"Some useful Dockerfile templates","\u002Fposts\u002Fdocker\u002Fdockerfile-templates","posts\u002Fdocker\u002Fdockerfile-templates",{"title":272,"path":273,"stem":274,"icon":230},"Setup Docker environment on Windows","\u002Fposts\u002Fdocker\u002Fsetup-docker-on-window","posts\u002Fdocker\u002Fsetup-docker-on-window",{"title":276,"icon":277,"redirect":278,"path":279,"stem":280,"children":281,"page":256},"Git & GitHub","material-icon-theme:git","\u002Fposts\u002Fgit\u002Fbrightly-decorate-graph","\u002Fposts\u002Fgit","posts\u002Fgit",[282,285,289,293,297],{"title":283,"path":278,"stem":284,"icon":230},"Brightly decorate your GitHub Graph","posts\u002Fgit\u002Fbrightly-decorate-graph",{"title":286,"path":287,"stem":288,"icon":230},"Download a specific folder on GitHub repository","\u002Fposts\u002Fgit\u002Fdownload-specific-folder","posts\u002Fgit\u002Fdownload-specific-folder",{"title":290,"path":291,"stem":292,"icon":230},"Syncing Git Tags across to other repositories","\u002Fposts\u002Fgit\u002Fsyncing-tags-across-repositories","posts\u002Fgit\u002Fsyncing-tags-across-repositories",{"title":294,"path":295,"stem":296,"icon":230},"Unlocking GitHub Achievement badges","\u002Fposts\u002Fgit\u002Funlocking-achievement-badges","posts\u002Fgit\u002Funlocking-achievement-badges",{"title":298,"path":299,"stem":300,"icon":230},"Essential Git commands every developer should master","\u002Fposts\u002Fgit\u002Fuseful-commands-like-pro","posts\u002Fgit\u002Fuseful-commands-like-pro",{"title":302,"icon":303,"redirect":304,"path":305,"stem":306,"children":307,"page":256},"Golang","material-icon-theme:go","\u002Fposts\u002Fgolang\u002Foptimizing-performance-with-pgo","\u002Fposts\u002Fgolang","posts\u002Fgolang",[308],{"title":309,"path":304,"stem":310,"icon":230},"Optimizing Performance in Go Applications with PGO","posts\u002Fgolang\u002Foptimizing-performance-with-pgo",{"title":312,"icon":313,"redirect":314,"path":315,"stem":316,"children":317,"page":256},"JavaScript","vscode-icons:file-type-js","\u002Fposts\u002Fjavascript\u002F9-lines-of-tips","\u002Fposts\u002Fjavascript","posts\u002Fjavascript",[318,321],{"title":319,"path":314,"stem":320,"icon":230},"9 lines of JavaScript replace 50 lines of code","posts\u002Fjavascript\u002F9-lines-of-tips",{"title":322,"path":323,"stem":324,"icon":230},"Javascript Promises - Specific functions and use cases","\u002Fposts\u002Fjavascript\u002Fpromises-cheatsheet","posts\u002Fjavascript\u002Fpromises-cheatsheet",{"title":326,"icon":327,"redirect":328,"path":329,"stem":330,"children":331,"page":256},"Node","material-icon-theme:nodejs-alt","\u002Fposts\u002Fnodejs\u002Fevent-loop","\u002Fposts\u002Fnodejs","posts\u002Fnodejs",[332],{"title":333,"path":328,"stem":334,"icon":230},"Secret about Event Loop flow in Nodejs","posts\u002Fnodejs\u002Fevent-loop",{"title":336,"icon":337,"redirect":338,"path":339,"stem":340,"children":341,"page":256},"Nuxt","vscode-icons:file-type-nuxt","\u002Fposts\u002Fnuxt\u002Fenable-pwa-in-nuxt","\u002Fposts\u002Fnuxt","posts\u002Fnuxt",[342],{"title":343,"path":338,"stem":344,"icon":230},"Enable PWA and Service Worker in Nuxt","posts\u002Fnuxt\u002Fenable-pwa-in-nuxt",{"title":346,"icon":347,"redirect":348,"path":349,"stem":350,"children":351,"page":256},"Performance","emojione:rocket","\u002Fposts\u002Fperformance\u002Fbackground-image-injection-problem","\u002Fposts\u002Fperformance","posts\u002Fperformance",[352],{"title":353,"path":348,"stem":354,"icon":230},"Background-Image injection problem in UX","posts\u002Fperformance\u002Fbackground-image-injection-problem",{"title":356,"icon":357,"redirect":358,"path":359,"stem":360,"children":361,"page":256},"Tutorial","fluent-color:book-open-lightbulb-24","\u002Fposts\u002Ftutorial\u002Fclassification-and-functionality-of-the-servers","\u002Fposts\u002Ftutorial","posts\u002Ftutorial",[362,365,369,373,377],{"title":363,"path":358,"stem":364,"icon":230},"Classification and functionality of the servers","posts\u002Ftutorial\u002Fclassification-and-functionality-of-the-servers",{"title":366,"path":367,"stem":368,"icon":230},"What is the difference between localhost and 127.0.0.1?","\u002Fposts\u002Ftutorial\u002Fdifferent-between-localhost-and-127-0-0-1","posts\u002Ftutorial\u002Fdifferent-between-localhost-and-127-0-0-1",{"title":370,"path":371,"stem":372,"icon":230},"8 essential network protocols every programmer should know","\u002Fposts\u002Ftutorial\u002Fessential-network-protocols","posts\u002Ftutorial\u002Fessential-network-protocols",{"title":374,"path":375,"stem":376,"icon":230},"Pre rels in header link tag - SEO technique enhancement","\u002Fposts\u002Ftutorial\u002Fpre-rels-in-header-link-tag","posts\u002Ftutorial\u002Fpre-rels-in-header-link-tag",{"title":378,"path":379,"stem":380,"icon":230},"Better code with SOLID principles","\u002Fposts\u002Ftutorial\u002Fwhat-is-solid","posts\u002Ftutorial\u002Fwhat-is-solid",{"title":382,"icon":383,"redirect":384,"path":385,"stem":386,"children":387,"page":256},"UI\u002FUX","devicon:figma","\u002Fposts\u002Fuiux\u002Fcommon-button-mistake","\u002Fposts\u002Fuiux","posts\u002Fuiux",[388],{"title":389,"path":384,"stem":390,"icon":230},"Common Button Mistake in UI\u002FUX","posts\u002Fuiux\u002Fcommon-button-mistake",{"title":392,"icon":393,"path":394,"stem":395,"children":396,"page":256},"Cheatsheets","fluent-color:paw-16","\u002Fcheatsheets","cheatsheets",[397,402,407,410,415,418,423,427,432,437,442,447,452,457,461,465,470,475,479,484,489,494],{"title":398,"path":399,"stem":400,"icon":401},"Bash","\u002Fcheatsheets\u002Fbash","cheatsheets\u002Fbash","material-icon-theme:powershell",{"title":403,"path":404,"stem":405,"icon":406},"CSS","\u002Fcheatsheets\u002Fcss","cheatsheets\u002Fcss","vscode-icons:file-type-css2",{"title":258,"path":408,"stem":409,"icon":259},"\u002Fcheatsheets\u002Fdocker","cheatsheets\u002Fdocker",{"title":411,"path":412,"stem":413,"icon":414},"Git","\u002Fcheatsheets\u002Fgit","cheatsheets\u002Fgit","devicon:git",{"title":302,"path":416,"stem":417,"icon":303},"\u002Fcheatsheets\u002Fgo","cheatsheets\u002Fgo",{"title":419,"path":420,"stem":421,"icon":422},"HTML","\u002Fcheatsheets\u002Fhtml","cheatsheets\u002Fhtml","material-icon-theme:html",{"title":312,"path":424,"stem":425,"icon":426},"\u002Fcheatsheets\u002Fjavascript","cheatsheets\u002Fjavascript","material-icon-theme:javascript",{"title":428,"path":429,"stem":430,"icon":431},"Latex","\u002Fcheatsheets\u002Flatex","cheatsheets\u002Flatex","material-icon-theme:latexmk",{"title":433,"path":434,"stem":435,"icon":436},"Linux","\u002Fcheatsheets\u002Flinux","cheatsheets\u002Flinux","devicon:linux",{"title":438,"path":439,"stem":440,"icon":441},"Markdown","\u002Fcheatsheets\u002Fmarkdown","cheatsheets\u002Fmarkdown","material-icon-theme:markdown",{"title":443,"path":444,"stem":445,"icon":446},"Mongo","\u002Fcheatsheets\u002Fmongo","cheatsheets\u002Fmongo","devicon:mongodb",{"title":448,"path":449,"stem":450,"icon":451},"Nest","\u002Fcheatsheets\u002Fnest","cheatsheets\u002Fnest","material-icon-theme:nest",{"title":453,"path":454,"stem":455,"icon":456},"Next","\u002Fcheatsheets\u002Fnext","cheatsheets\u002Fnext","logos:nextjs-icon",{"title":326,"path":458,"stem":459,"icon":460},"\u002Fcheatsheets\u002Fnode","cheatsheets\u002Fnode","material-icon-theme:nodejs",{"title":336,"path":462,"stem":463,"icon":464},"\u002Fcheatsheets\u002Fnuxt","cheatsheets\u002Fnuxt","material-icon-theme:nuxt",{"title":466,"path":467,"stem":468,"icon":469},"React","\u002Fcheatsheets\u002Freact","cheatsheets\u002Freact","material-icon-theme:react",{"title":471,"path":472,"stem":473,"icon":474},"Redis","\u002Fcheatsheets\u002Fredis","cheatsheets\u002Fredis","vscode-icons:folder-type-redis-opened",{"title":476,"path":477,"stem":478,"icon":248},"SQL","\u002Fcheatsheets\u002Fsql","cheatsheets\u002Fsql",{"title":480,"path":481,"stem":482,"icon":483},"Typescript","\u002Fcheatsheets\u002Ftypescript","cheatsheets\u002Ftypescript","material-icon-theme:typescript",{"title":485,"path":486,"stem":487,"icon":488},"Vercel","\u002Fcheatsheets\u002Fvercel","cheatsheets\u002Fvercel","vscode-icons:file-type-light-vercel",{"title":490,"path":491,"stem":492,"icon":493},"Vue","\u002Fcheatsheets\u002Fvue","cheatsheets\u002Fvue","material-icon-theme:vue",{"title":495,"path":496,"stem":497,"icon":498},"Windows","\u002Fcheatsheets\u002Fwindow","cheatsheets\u002Fwindow","material-icon-theme:folder-windows",{"title":500,"icon":501,"path":502,"stem":503,"children":504,"page":256},"Prompts","fluent-color:bot-sparkle-24","\u002Fprompts","prompts",[505],{"title":506,"path":507,"stem":508,"children":509,"page":256},"Image Generation","\u002Fprompts\u002Fimage-generation","prompts\u002Fimage-generation",[510],{"title":511,"path":512,"stem":513,"icon":501},"Futuristic Cloud Workspace","\u002Fprompts\u002Fimage-generation\u002Ffuturistic-cloud-workspace","prompts\u002Fimage-generation\u002Ffuturistic-cloud-workspace",{"title":515,"icon":516,"path":517,"stem":518,"children":519,"page":256},"Interviews","lucide:messages-square","\u002Finterviews","interviews",[520,524,529,532,536,541,546,551,556,561,566],{"title":521,"path":522,"stem":523,"icon":516},"Behavioral Engineering","\u002Finterviews\u002Fbehavioral-engineering","interviews\u002Fbehavioral-engineering",{"title":525,"path":526,"stem":527,"icon":528},"DevOps and Cloud","\u002Finterviews\u002Fdevops-cloud","interviews\u002Fdevops-cloud","logos:docker-icon",{"title":419,"path":530,"stem":531,"icon":422},"\u002Finterviews\u002Fhtml","interviews\u002Fhtml",{"title":312,"path":533,"stem":534,"icon":535},"\u002Finterviews\u002Fjavascript","interviews\u002Fjavascript","logos:javascript",{"title":537,"path":538,"stem":539,"icon":540},"Node.js and API Design","\u002Finterviews\u002Fnodejs-api","interviews\u002Fnodejs-api","logos:nodejs-icon",{"title":542,"path":543,"stem":544,"icon":545},"Software Testing","\u002Finterviews\u002Fsoftware-testing","interviews\u002Fsoftware-testing","lucide:flask-conical",{"title":547,"path":548,"stem":549,"icon":550},"SQL and Databases","\u002Finterviews\u002Fsql-databases","interviews\u002Fsql-databases","lucide:database",{"title":552,"path":553,"stem":554,"icon":555},"System Design","\u002Finterviews\u002Fsystem-design","interviews\u002Fsystem-design","lucide:network",{"title":557,"path":558,"stem":559,"icon":560},"TypeScript","\u002Finterviews\u002Ftypescript","interviews\u002Ftypescript","logos:typescript-icon",{"title":562,"path":563,"stem":564,"icon":565},"Vue and Nuxt","\u002Finterviews\u002Fvue-nuxt","interviews\u002Fvue-nuxt","logos:nuxt-icon",{"title":5,"path":232,"stem":236,"icon":228},[568,230],{"title":562,"path":563,"stem":564,"children":-1}]