Web security

Web security interviews defend browser-facing applications from injection, request forgery, cross-origin mistakes, clickjacking, and missing security headers.

Subtopics: XSS, SQL and NoSQL injection, CSRF/SSRF/clickjacking, and CORS/CSP/secure headers.

On interviews: explain contextual output encoding vs parameterized queries, CSRF token or SameSite strategy, and a minimal CSP that blocks inline script abuse.

Common pitfalls: escaping HTML for JavaScript contexts, open redirects enabling token theft, and permissive CORS combined with cookie sessions.

The trade-off is balancing simplicity, performance, safety, and operability — name which axis you optimized and what cost you accepted.

Checklist:

• Validate input; encode output for its sink context.
• Use parameterized queries and schema validation.
• Protect state-changing requests from CSRF.
• Deploy CSP and security headers as defense in depth.