Security questions Indian IT companies ask — auth, OWASP, and safe API design.
OWASP lists critical web risks: broken access control, injection, insecure design, misconfiguration, vulnerable components, auth failures, data integrity failures, logging failures, SSRF, etc. Indian full-stack and backend interviews expect you to name a few and give mitigation — shows production awareness beyond DSA.
TLS encrypts data in transit, prevents eavesdropping and tampering, and authenticates server via certificates. Always use HTTPS in production; HSTS header forces browsers to stay on HTTPS. Never send tokens or passwords over plain HTTP.
Authentication: prove who you are (login). Authorization: what you're allowed to do (role permissions). Bug pattern: authenticated user accesses another user's data (broken access control) — test with two accounts in interviews/projects.
JSON Web Token: signed claims (user id, expiry) used in stateless APIs. Prefer HttpOnly, Secure cookies for browser apps to reduce XSS theft; if in localStorage, strict XSS prevention required. Always validate signature and expiry server-side.
Delegated authorization: user consents for app A to access limited data on app B (Google login) without sharing password. Uses authorization code flow with PKCE for SPAs/mobile. Know roles: resource owner, client, authorization server, resource server.
Attacker injects SQL via input fields to read/modify DB. Prevent with parameterized queries/prepared statements (never string concat), ORM safe APIs, least-privilege DB users, and input validation. Classic question still asked in service company tests.
Injecting malicious scripts into pages viewed by others (stored, reflected, DOM-based). Prevent: escape output, Content-Security-Policy, sanitize rich text, HttpOnly cookies. React escapes by default but dangerouslySetInnerHTML and APIs need care.
Cross-Site Request Forgery: trick logged-in user's browser to submit unwanted actions. Mitigate: CSRF tokens for cookie-based sessions, SameSite cookies, verify Origin/Referer. Less issue for pure JWT in Authorization header without cookies.
Cross-Origin Resource Sharing: browser blocks JS from reading another domain unless server sends Access-Control-Allow-Origin. Misconfiguration can expose APIs; overly permissive * with credentials is wrong. Backend must whitelist trusted frontends.
Never plain text. Use slow adaptive hashing: bcrypt, Argon2, or scrypt with unique salt per user. Pepper in KMS optional. On login, hash input and compare. Mention password reset tokens hashed and short-lived.
Cap requests per IP/user/API key to prevent brute force, scraping, and DDoS abuse. Return 429, use sliding window in Redis, stricter limits on login/OTP endpoints. Standard in public APIs and campus-built SaaS projects.
Content-Security-Policy, X-Frame-Options (clickjacking), X-Content-Type-Options, Strict-Transport-Security, Referrer-Policy. Set via NGINX or framework middleware. Quick win for full-stack project demos.
Changing ID in URL/API (/orders/5 → /orders/6) accesses others' data. Fix: authorize every request against logged-in user, use non-guessable UUIDs, server-side ownership checks — not security by obscurity.
API keys identify project/server access — fine server-to-server if rotated and never in frontend repos. User-specific actions need OAuth/JWT with scopes. Never commit keys to GitHub; use env vars and secret scanning.
Validate type, length, format on server always; client validation is UX only. Use schema validators (Zod, Joi, Pydantic). Reject unexpected fields (mass assignment attacks). Sanitize file uploads (type, size, scan).
Server-Side Request Forgery: attacker tricks server into calling internal URLs (metadata service, admin ports). Mitigate: allowlist outbound hosts, block private IP ranges, no raw user-supplied URLs without checks. Listed in OWASP Top 10 2021.
Users, services, and DB accounts get minimum permissions needed. Microservices IAM roles, read-only analytics users, separate prod/dev credentials. Reduces blast radius when credentials leak — common security culture question.
Check MIME/extension, size limits, store outside web root, generate random filenames, scan for malware, serve via signed URLs, never execute uploaded content. Prevents webshell attacks on student project hosting.
Log auth events, permission denials, admin actions — without logging passwords or full PAN/Aadhaar. Centralize logs, protect integrity, retain for audits. Helps forensics after incident; required for compliance-minded clients.
Threat model main flows, dependency updates, HTTPS, parameterized SQL, authZ checks, secrets in env, security headers, basic OWASP scan (ZAP), code review checklist. Shows maturity beyond feature completion in portfolio reviews.
