Web application security interview questions
Questions about browser and server security, including cross-site scripting, CSRF, SQL injection, authentication and request handling. Follow-ups change the scenario or ask you to explain how a defence works.
This topic has 21 opening questions and 127 follow-ups in the interview. Choose this domain in setup to practise it by voice or text.
How would you store user passwords?
Tell me about broken access control.
Tell me about clickjacking.
What does CORS do — and what stands out about these response headers?
HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST Content-Type: application/json {"user_id": 1042, "email": "alice@example.com", "role": "admin"}What is cross-site request forgery?
Tell me about a signed, unencrypted JSON Web Token: what does it contain, and what can the server trust?
An online shop lets you apply a discount code at checkout. How would you go about attacking that?
This React component showed up in a security review. Walk me through what you would say on the pull request.
function UserBadge({ profile }) { const bioHtml = profile.bio; // already sanitized server-side, says the PR return ( <article className="badge"> <h2>{profile.displayName}</h2> <div dangerouslySetInnerHTML={{ __html: bioHtml }} /> <a href={profile.website}>Visit site</a> </article> ); }Tell me about SQL injection.
What is an SSRF vulnerability?
Tell me about server-side template injection.
A feature lets users upload a profile picture. What worries you?
Tell me about what Cross-Site Scripting is.
A marketing site sits behind a CDN that caches GET responses for ten minutes, keyed on path and query string only. The application reads X-Forwarded-Host to build absolute URLs in the HTML, including a script src, and varies the page language on Accept-Language. A researcher reports that every visitor to the home page loads a script from a domain they control, for ten minutes at a time. How is the researcher doing that, and why does it reach other visitors?
A ten-year-old server-rendered application has hundreds of templates with inline script blocks and inline event handlers, loads analytics and a chat widget from two third-party domains, and has fixed three reflected XSS findings this year one at a time. It sends no Content-Security-Policy header today. The team wants CSP as a mitigation for the next XSS. What can a policy do here, and what can it not do?
What is insecure deserialisation?
Our web app lets a user connect a third-party calendar. We are the OAuth client, using the authorization code flow: the provider redirects the user back to https://app.example.com/oauth/callback with a code and our server exchanges it for tokens. The redirect URI is registered exactly as that URL. Our requests send neither state nor PKCE. Access and refresh tokens are stored per user in our database. Review this integration. What is missing, and what does each missing piece actually protect against here?
What is a race condition in a web application?
A web app issues a session cookie at login: a random 128-bit id stored in Redis, Secure and HttpOnly set, no SameSite, no cookie expiry. The Redis record has a 30-day TTL refreshed on every request. Users can be logged in on several devices. Changing the password does not touch sessions. There is no sign out everywhere. A support engineer asks how to help a user who thinks someone else is using their account. What does this design let you do, and what would you change?
Have you come across HTTP request smuggling? Tell me how it works.
A collaboration product adds wss://app.example.com/ws for live updates. The browser connects after login; the app authenticates with a session cookie. The server accepts the upgrade when the cookie is valid, then handles JSON messages such as subscribe and edit, each carrying a document id. Nothing checks the document id against the user's permissions; the code assumes the client only asks for documents it can see. What can go wrong with this endpoint, and who can cause it?
Each question is beginner or advanced. The tier describes the starting question; it is a practice label, not a certification. Questions by Pratik Amin.