Backend security interview questions

Object-level authorization, injection, SSRF, CSRF, XSS, secrets, request signing, credential stuffing, TLS, mass assignment, supply chain and security headers.

5 quick facts

– interview-ready · 12 questions in this topic

– of 12 tried

Saved on this device. Interview-ready means you got it right on two different days. Guesses and hints count for less.

Questions

  1. Broken object level authorization (BOLA)Spot the bug
  2. SQL injection and parameterised queriesPredict
  3. Server-side request forgery (SSRF)Predict
  4. CSRF and how cookies cause itPick the fix
  5. XSS from a backend's point of viewPredict
  6. Managing secretsOrder the steps
  7. Signing requests and webhooks with HMACPredict
  8. Credential stuffing and brute forcePick the fix
  1. Encryption in transit and at restPick the fix
  2. Mass assignmentSpot the bug
  3. Dependency and supply-chain securityPick the fix
  4. HTTP security headersPick the fix

Practise this topic

Flashcards · 17

Flip, then say if you knew it. Needs JavaScript; every answer is also on its question page.

Quick quiz · 12 questions

One exercise per question, checked as you go. Needs JavaScript.

Mock interview · 2 sets

Timed, out loud, then tick what you covered. Needs JavaScript.

Fix this PR · 2 reviews

Review a diff like a senior: flag the lines you'd comment on. Needs JavaScript.

Quick facts

Recall the answer first, then tap Show to check.

Printable cheat sheet · Review your weak spots in this topic

Sources: Topic outline informed by System Design Primer by Donne Martin and the Zalando RESTful API Guidelines, both licensed under CC BY 4.0. Every question and answer is written by Best Latest Apps. Credits and license