Backend Developer
Web application security questions
36 questions on Web application security for backend developers, easiest first.
Easy 13
- Stopping SQL injectioneasy
- How to store passwordseasy
- Keeping secrets out of codeeasy
- Browser blocks a call that curl allowseasy
- What HttpOnly does on a cookieeasy
- Storing times for global userseasy
- What HTTPS leaves visibleeasy
- Database user for the appeasy
- Stack traces in production errorseasy
- What the Secure cookie flag doeseasy
- Why cookie auth needs CSRF thoughteasy
- Building SQL from user inputeasy
- What RabbitMQ vhosts are foreasy
Medium 16
- Logging out with JWTsmedium
- Webhook signature never matchesmedium
- Risk of "import image from URL"medium
- Any user can read any invoicemedium
- Saving req.body directlymedium
- CDN serves one user's profile to anothermedium
- A nested GraphQL query overloads the servermedium
- What SameSite=Lax allowsmedium
- Cookie ignored in an embedded widgetmedium
- Cookie leaks to every subdomainmedium
- Credentialed requests with Allow-Origin *medium
- Why OAuth uses a state parametermedium
- What the __Host- cookie prefix needsmedium
- Data inside a signed cookiemedium
- Logging in with an operator as passwordmedium
- Fail open or fail closedmedium