Security
305 bites tagged Security — interview questions with model answers, and 60-second explainers.
Restricting Pod ingress with a NetworkPolicy
Create a NetworkPolicy with podSelector app=frontend, policyTypes Ingress, and one ingress from-rule matching podSelector role=api-gateway; requires a CNI that enforces policies. NetworkPolicy ingress control.
Vulnerability scanning as a deploy gate
Scan with Trivy or Clair, fail the build on high or critical severity above threshold, and enforce again at admission with signing and registry policies. shift-left image security in CI/CD.
What is SAST and which CI/CD stage integrates it best?
Define SAST as source-code scanning; run it in the test stage on every commit; note early detection is cheapest. Shift-left thinking and where static analysis belongs in CI/CD.
How would you integrate artifact signing into CI/CD and secure the keys?
Tests supply chain architecture and secrets management. A strong answer: remote HSM or KMS signing isolated from build runners, signature verification at deploy gates, and key rotation with audit logging.
What does shift left mean in CI/CD, and give two concrete examples?
Your grasp of moving verification earlier to reduce cost and risk. Define shift left as earlier-stage testing; cite two concrete examples like pre-commit unit tests and PR-level SAST scans. Never call it "more testing" instead of earlier feedback.
What is the purpose of +page.server.js in SvelteKit?
Exclusively server-side load feeding the data prop, used for secrets like DB queries and private env vars. Server-only load boundaries in SvelteKit. Claiming it runs in the browser or equating it with +page.js.
How would you secure a moderated screen-sharing session end to end?
Cover encrypted WebRTC transport, KMS-backed storage, access controls, PII redaction, and retention policies. Privacy architecture for sensitive streaming data and stored artifacts.
Mozilla WAICT Verifies Web App JavaScript in Nightly
WAICT in Firefox Nightly binds client code to public manifests so browsers reject unlogged JavaScript. This stops compromised servers from silently injecting malicious code into encrypted web apps like Signal. Test it at waict.dev.
Claude Mythos Cracks Firefox Bugs Fuzzing Missed
Claude Mythos Preview found 20-year-old XSLT and JIT bugs in Firefox that survived years of fuzzing. Mozilla shows AI now catches sandbox escapes and memory corruption. Add LLM security scanning to hardening workflows before attackers adopt them.
How do you include a JWT in a fetch request?
Tests knowledge of the fetch options object and Bearer scheme syntax. A strong answer sets headers: { Authorization: Bearer <token> } as the second argument and notes fetch does not auto-attach tokens. Red flag: omitting Bearer or hardcoding secrets.
Vercel Connect replaces env tokens with runtime OIDC
Vercel Connect Public Beta replaces static env tokens with short-lived, task-scoped credentials exchanged at runtime via OIDC. Agents request least-privilege access per job instead of holding long-lived shared secrets, eliminating manual rotation when…
Describe a robust automatic token refresh strategy in a React SPA
This tests token rotation without UX interruption in SPAs. Use HttpOnly cookies for refresh tokens, in-memory access tokens, an interceptor with a promise lock, and proactive background refresh.
Would you use getServerSideProps or getStaticProps for private user data?
Tests SSR vs SSG privacy. Use getServerSideProps: it runs per-request with auth cookies. getStaticProps bakes HTML/JSON at build time, leaking private data across users. Red flag: suggesting ISR or revalidation for authenticated data.
How do you manage Next.js env variables on Vercel and use NEXT_PUBLIC_?
Set DB strings in Vercel dashboard without NEXT_PUBLIC_; consume in server code only. NEXT_PUBLIC_ inlines values into the browser JS bundle, leaking them to all users. Server-client boundary awareness and secret hygiene.
How to securely set and read httpOnly cookies in Route Handlers
This tests cookie security across the App Router. A strong answer covers setting httpOnly, Secure, SameSite via NextResponse in a Route Handler, reading with cookies() later, and why document.cookie cannot access it. Red flag: client-side JavaScript access.
Protected Routes: Server Gates, Not Hidden Links
A protected route is a server-enforced gate, not a hidden link. In Next.js, middleware or server components validate sessions before HTML ships, which matters for dashboards and billing.
How do you authenticate a FastAPI WebSocket connection?
This tests WebSocket limits and FastAPI dependency injection. Pass the JWT via query parameter or cookie at handshake, validate it with Depends, and reject with HTTP 403 or 1008 close.
How do you disable FastAPI docs but keep the OpenAPI schema?
Tests FastAPI constructor routing: docs_url, redoc_url, and openapi_url. Answer: pass docs_url=None and redoc_url=None while keeping openapi_url="/openapi.json", gated by env var. Red flag: middleware or manual route deletion instead of native configuration.
Frontend on localhost:3000 gets errors calling FastAPI on localhost:8000. Name and fix?
This tests whether different ports mean different origins, causing CORS errors. A strong answer names CORS, notes ports are distinct origins, and outlines using CORSMiddleware with allow_origins.
What JWT claims must you validate beyond the signature?
This tests whether you understand token misuse beyond crypto: time validity, audience and issuer binding, algorithm whitelisting, and required claims enforcement. Red flag: only checking signature and ignoring exp or aud.
How do OAuth2 scopes enable granular permissions in FastAPI versus role-based checks?
Tests OAuth2 scope granularity vs RBAC and FastAPI SecurityScopes. Strong answers mention JWT claim strings, SecurityScopes per endpoint, and that RBAC is coarse while scopes are fine-grained. Red flag: treating scopes as roles or skipping claim checks.
Implement RBAC in FastAPI with a JWT role dependency
Build a dependency that decodes the JWT, checks the role, raises 403 if not admin, and inject via Depends. FastAPI dependency composition for JWT role validation. parsing headers inside route not using dependencies.
Implement OAuth2 Password Flow in FastAPI
Tests FastAPI security integration and stateless auth patterns. A strong answer covers the POST /token endpoint returning a JWT, the OAuth2PasswordBearer dependency, and get_current_user decoding the JWT sub.
What are the three components of a JWT?
Tests if you know JWT structure beyond library usage. A strong answer lists header, payload, and signature; notes Base64Url encoding; and gives a registered claim like exp. A red flag is confusing signing with encryption.
Get Security bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.