Security Best Practices

Question 1

What is SQL injection, and how do you prevent it?

Answer 1

SQL injection inserts malicious SQL via user input. Prevent with parameterized queries. Example: In Node.js with pg: await pool.query('SELECT * FROM users WHERE id = $1', [userId]); avoids injection.

Question 2

How do you prevent Cross-Site Scripting (XSS) in a full-stack app?

Answer 2

Sanitize user input and escape output. Example: Use DOMPurify in React to clean HTML input, or set Content-Security-Policy headers in Express to limit scripts.

Question 3

What is CSRF, and how do you mitigate it?

Answer 3

CSRF (Cross-Site Request Forgery) tricks users into unwanted actions. Mitigate with CSRF tokens. Example: Use csurf middleware in Express to validate tokens on POST requests.

Question 4

How do you securely store passwords in a backend?

Answer 4

Hash passwords with a strong algorithm like bcrypt. Example: const bcrypt = require('bcrypt'); bcrypt.hash('password', 10, (err, hash) => { /* store hash */ });.

Question 5

What are secure HTTP headers, and which are critical?

Answer 5

Secure headers protect against attacks. Critical: Strict-Transport-Security (enforces HTTPS), X-Content-Type-Options: nosniff (prevents MIME sniffing). Set via Helmet in Express.

Question 6

How do you implement secure JWT authentication?

Answer 6

```javascript
const jwt = require(‘jsonwebtoken’);
function generateToken(user) {
return jwt.sign({ id: user.id }, ‘secret’, { expiresIn: ‘1h’ });
}
// Explanation: Use short-lived tokens, store secret securely, verify on each request.
~~~

Question 7

What is the principle of least privilege in security?

Answer 7

Grant minimal access needed. Example: Use a database user with read-only access for API queries, not admin privileges, to limit damage if compromised.

Question 8

How do you protect against API abuse?

Answer 8

Implement rate limiting and input validation. Example: Use express-rate-limit to cap requests at 100/hour per IP, validate payloads with Joi.

Question 9

What is an OWASP Top 10 vulnerability?

Answer 9

OWASP Top 10 lists common security risks. Example: Broken Authentication (e.g., weak passwords). Mitigate with strong passwords, MFA, and JWT validation.

Question 10

How do you secure sensitive environment variables?

Answer 10

Store in .env files, exclude from Git, and use secrets management (e.g., AWS Secrets Manager). Example: DB_URL=postgres://... loaded with dotenv in Node.js.