Security
305 bites tagged Security — interview questions with model answers, and 60-second explainers.
Multi-stage Docker builds for lean production images?
Build stage compiles/installs, runtime stage copies artifacts only, discards build tools. Docker build optimization and separation of build and runtime.
Environment configuration and secrets management in Node.js?
Use environment variables, load from .env file (dev only), never commit secrets. production safety and configuration best practices.
How to authenticate WebSocket connections using JWTs?
Client sends JWT on connection, server validates via middleware, socket is attached to user. WebSocket auth patterns and middleware understanding.
What is PII and how to keep it out of logs
Define PII, redact or mask at the logging boundary, and avoid logging sensitive fields at the source. understanding PII plus a concrete log-hygiene strategy.
localStorage vs httpOnly cookie for auth tokens
LocalStorage is JS-readable so XSS steals it; httpOnly cookies are JS-invisible blocking XSS theft but exposed to CSRF, mitigated by SameSite and tokens. Token storage security trade-offs.
Secure refresh token flow for access renewal
Short-lived access token, longer-lived refresh token stored server-side, a refresh endpoint that validates and rotates the refresh token issuing a new pair. Designing the access plus refresh token pattern.
Revoking stateless JWTs on logout
A server-side denylist of revoked token IDs checked per request, or short-lived access tokens paired with revocable refresh tokens. Reconciling stateless tokens with real revocation.
Strict tenant isolation in a multi-tenant data layer
Choose silo, pool, or bridge by risk; enforce tenant scoping at multiple layers with RLS; encrypt and audit. Whether you know the isolation models and defense in depth.
JWT login and protected route flow in Express
Verify credentials, sign a JWT, client stores and sends it (Authorization header or httpOnly cookie), middleware verifies signature on protected routes. end-to-end JWT auth flow and storage tradeoffs.
Managing secrets for containerized Node.js on Kubernetes
Use Kubernetes Secrets or an external vault, mount as files not env, encrypt at rest, rotate. secure secret handling in orchestration. baking credentials into images or trusting plain env vars as secure.
JWT storage: localStorage versus HttpOnly cookie
LocalStorage is JS-readable so XSS steals the token; HttpOnly cookies resist XSS theft but reintroduce CSRF, mitigated by SameSite plus CSRF tokens. Reasoning about XSS/CSRF trade-offs in token storage.
Prototype pollution: how it works and prevention
Attacker writes to Object.prototype via __proto__ keys in merge/parse code, poisoning all objects; prevent by guarding keys, null-prototype objects, Object.freeze, Map, and patched deps. Deep JS object-model security.
Deploying a strict CSP for an Express SPA
Define directives, start in Report-Only to gather violations, then enforce; allow inline code via per-request nonces or hashes plus strict-dynamic instead of unsafe-inline. Real CSP rollout without unsafe-inline.
Auditing and fixing vulnerable npm dependencies
Run npm audit (or yarn audit) to list advisories, npm audit fix to patch within semver, bump majors deliberately, and lock versions; wire audits into CI. Practical dependency hygiene.
Input validation versus output encoding
Validation checks input fits expected rules on entry; encoding makes data safe for a specific output context on exit. You need both; encoding is the real anti-XSS control. Knowing these are complementary, not interchangeable.
Preventing SQL injection with parameterized queries
The flaw is SQL injection; prevent it with parameterized queries/prepared statements (pg $1, mysql2 ?), never string concatenation, so input is data not code. Knowing SQL injection and parameterization.
Explaining and preventing CSRF in Express
CSRF abuses a victim's ambient cookies to forge state-changing requests; the server issues an unpredictable token tied to the session, embeds it in forms, and validates it… Understanding CSRF and the synchronizer-token pattern.
Preventing XSS when rendering user content in templates
The risk is XSS; default to escaped interpolation (EJS <%= %>, Pug #{}) so HTML is encoded, and avoid raw output (<%- %>) for untrusted data. Knowing XSS and contextual output encoding.
Purpose of Helmet middleware in Express
Helmet sets safe response headers like X-Content-Type-Options, HSTS, and CSP, mitigating MIME-sniffing, clickjacking, and protocol downgrade. Awareness of HTTP security headers and defense in depth.
JWT storage: localStorage versus httpOnly cookies
LocalStorage is readable by JS so XSS can steal the token but no CSRF; httpOnly cookies block XSS theft but are auto-sent, enabling CSRF unless mitigated. client-side token storage threats.
Strategies for revoking stateless JWTs
Short-lived access tokens with refresh-token rotation, or a server-side denylist of revoked token ids, weighing statelessness against immediacy. JWT revocation trade-offs.
Role-based access control middleware in Express
Authenticate first to set req.user, then a parameterized role-check middleware that compares req.user.role and returns 403 if it fails, applied to protected routes. layered authorization design.
Securing Express with Passport local strategy
Configure LocalStrategy with a verify callback, call passport.authenticate as route middleware, and set up serializeUser/deserializeUser for sessions. practical Passport.js wiring.
JWT structure and how the signature works
Name header, payload, and signature, note the first two are base64url-encoded not encrypted, explain the signature is computed over header and payload with a secret to detect tampering. understanding of JWT anatomy.
Get Security bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.