You are asked to review the security of a REST API before launch. What would you check?
What the interviewer wants to hear
- Authentication strength and authorization on every object (IDOR/BOLA)
- Input validation, parameterized queries, mass assignment
- HTTPS, secure headers, CORS and cookie settings
- Secrets management and least-privilege access
- Rate limiting, logging and dependency scanning
Model answer
I would go through the OWASP API Security Top 10. The first thing is authorization on every object: can user A fetch user B's order by changing an id? Then authentication: strong password hashing, short-lived tokens, and protection against brute force on login. Next, input: every request validated with a schema, only allowlisted fields saved to prevent mass assignment, and all SQL parameterized. I would check transport and browser settings: HTTPS only, HSTS, a strict CORS allowlist, and cookies with HttpOnly, Secure and SameSite. Then secrets: none in the code or images, stored in a secret manager, with database users on least privilege. I would also confirm rate limits, safe error messages without stack traces, audit logs for sensitive actions, and dependency and container scanning in CI. Finally, any feature that fetches URLs is checked for SSRF.
Can you answer it under time pressure?
Take a timed medium round and get scored on every answer.
More medium Backend Developer questions
- An API endpoint is slow because it runs a heavy database query. How would you add caching, and how do you keep the cache correct?
- You need to rename a column in a large production table that the live app uses. How do you do it without downtime?
- How do you change a public API without breaking existing clients, such as old mobile app versions?
- Users say one API endpoint has become slow in production. How do you find and fix the cause?
- Sending emails and generating PDF invoices makes your checkout API slow. How would you move this work to the background?
- How would you add rate limiting to a public API that runs on many servers?
- Your service receives webhooks from a payment provider. How do you make handling them secure and reliable?
- When would you choose Kafka and when RabbitMQ for messaging between services?
- How would you design an API that lets users upload large files, such as videos of several gigabytes?