Q11. What is a GCP service account key and why should you avoid it?
A service account key is a downloadable JSON file containing a private key that lets any holder authenticate as that service account. It is long-lived and does not expire...
Technical Question Bank · Peer-Reviewed
Job Interview Questions and Answers Directory
Search and filter frequently asked interview questions across technical, programming, and behavioral domains. Tailor your interview preparation by difficulty for freshers or experienced developers (19 available).
Active:
Tag: security ×
Q12. What are the most common JWT security pitfalls?
- Accepting the `none` algorithm or trusting the token header for algorithm selection, which enables algorithm confusion attacks. Pin the expected algorithm server-side. ...
Q13. How do you handle authorization in a GraphQL API?
Authorization belongs in the server layer, never in the client query. Because clients can request any combination of fields, enforce rules at the field and object level, ...
Q14. What is output escaping and why is it important?
Output escaping encodes user-controlled data at the moment it is written into HTML so browsers treat it as text, not markup. This is the primary defence against XSS. ```p...
Q15. What is CSRF and how do you prevent it?
Cross-Site Request Forgery tricks a logged-in user's browser into sending an authenticated request to your site. Because browsers attach cookies automatically, a maliciou...
Q16. How do you protect a GraphQL endpoint from abusive queries?
Because clients can compose arbitrarily deep and wide queries, a single request can exhaust the database. Defences: - Limit query depth, for example reject anything deepe...
Q17. How does XSS relate to authentication security?
Cross-Site Scripting lets an attacker run JavaScript in your origin. Once that happens, the script can read anything the page can read, including tokens in `localStorage`...
Q18. Is it recommended to use eval?
No, it allows arbitrary code to be run which causes a security problem. As we know that the eval() function is used to run text as code. In most of the cases, it should n...
Q19. How do you prevent prototype pollution attacks in JavaScript?
Prototype pollution is a security vulnerability where attackers inject properties into Object.prototype, affecting all objects in the application. **Vulnerable code:** ``...