What are the main security risks for a frontend application and how do you protect against them?
What the interviewer wants to hear
- XSS: escape output, avoid raw HTML, sanitise, use CSP
- CSRF: SameSite cookies and CSRF tokens
- Token storage: prefer httpOnly secure cookies over localStorage
- Supply chain: audit and pin dependencies, lockfiles
- Never trust the client; validate on the server
- Clickjacking: frame-ancestors or X-Frame-Options
Model answer
The biggest risk is XSS. Frameworks like React escape text by default, so I avoid dangerouslySetInnerHTML, and when I must render user HTML I sanitise it with DOMPurify. I add a strict Content Security Policy with nonces so injected scripts cannot run. For auth, I prefer httpOnly, Secure, SameSite cookies over localStorage, because script cannot read them if XSS happens. SameSite plus CSRF tokens on state-changing requests protects against CSRF. Supply chain attacks are real, so I keep a lockfile, review new dependencies, run audits and limit third-party scripts. I set frame-ancestors to stop clickjacking. Most importantly, the frontend is never a security boundary: every permission and input must be checked on the server, and I never ship secrets in client bundles.
Can you answer it under time pressure?
Take a timed hard round and get scored on every answer.
More hard Frontend Developer questions
- How would you design and build a shared component library (design system) used by several product teams?
- A page must show a table with 50,000 rows and stay smooth while scrolling and filtering. How would you build it?
- Your company wants to split a large frontend into micro-frontends. What are the trade-offs and how would you approach it?
- What are React Server Components, and how do they change the way you build a React app?
- How would you design a web app that keeps working offline, for example for field workers with poor connectivity?
- You join a team with a large JavaScript React codebase. How would you migrate it to TypeScript without stopping feature work?
- How would you build the frontend for a real-time feature like a shared task board where many users edit at the same time?
- Users report that your single-page app becomes slow and crashes after being open for a few hours. How do you investigate and fix it?
- How do you know your frontend is healthy in production? Describe the monitoring you would set up.