Full Stack Developer
Web application security questions
150 questions on Web application security for full stack developers, easiest first.
Easy 46
- Fixing a CORS erroreasy
- Where to keep a secret keyeasy
- Preventing SQL injectioneasy
- Storing user passwordseasy
- The .env file and Giteasy
- What HttpOnly doeseasy
- What HTTPS protectseasy
- What triggers a preflighteasy
- Caching a bank statement pageeasy
- Stored versus reflected XSSeasy
- Writing location.hash into the pageeasy
- Encoding user text inside HTMLeasy
- What the Secure cookie flag doeseasy
- Purpose of Strict-Transport-Securityeasy
- X-Content-Type-Options: nosniffeasy
- Stopping clickjackingeasy
- Running a shell command with user inputeasy
- Download endpoint reads any fileeasy
- Slowing password guessingeasy
- Why turn on MFAeasy
- Top OWASP web riskeasy
- Login error wordingeasy
- Only validating in the browsereasy
- Known holes in librarieseasy
- Scope of a reporting keyeasy
- A sensible password ruleeasy
- HTTPS page loads an HTTP scripteasy
- Validating a country codeeasy
- SQL error in the API replyeasy
- Folder listing on the web servereasy
- Admin panel with admin/admineasy
- What a password salt stopseasy
- Session left open on a shared PCeasy
- Logout that only clears the cookieeasy
- Delete link using GETeasy
- Bots creating fake accountseasy
- JSON served as text/htmleasy
- Hiding the admin buttoneasy
- Generating a reset tokeneasy
- The S in STRIDEeasy
- SAST compared with DASTeasy
- Secret pushed to a public repoeasy
- Huge JSON body crashes the APIeasy
- Which uploads to accepteasy
- Defence in deptheasy
- Reading a CVSS scoreeasy
Medium 56
- JWT in localStoragemedium
- CSRF with cookie sessionsmedium
- When SameSite=Lax cookies are sentmedium
- Users see each other’s profilemedium
- User bios rendered as HTMLmedium
- Adding security headers to all pagesmedium
- XSS that JSX does not escapemedium
- User data inside a script blockmedium
- How a CSRF token worksmedium
- Double-submit cookiemedium
- Cookie for an embedded widgetmedium
- CORS wildcard and cookiesmedium
- Echoing the Origin headermedium
- MongoDB login bypassmedium
- XML upload reads server filesmedium
- Loading a pickled cookiemedium
- Profile picture uploaded as SVGmedium
- Same session ID after loginmedium
- Choosing a password hashmedium
- Hard lockout after 5 failuresmedium
- Script tag from a public CDNmedium
- Reset token leaks to analyticsmedium
- Request bodies in the logsmedium
- Detailed errors shown to usersmedium
- Reset link built from the Host headermedium
- A regex that freezes the servermedium
- The __Host- cookie prefixmedium
- Session cookie with Domain=.example.commedium
- Old CNAME to a deleted bucketmedium
- Allowing Origin: nullmedium
- What Trusted Types enforcesmedium
- Rolling out a CSP safelymedium
- Rate limit keyed on X-Forwarded-Formedium
- Deeply nested GraphQL querymedium
- Many login attempts in one requestmedium
- Secret key passed as ?api_key=medium
- Chance of guessing a 6-digit OTPmedium
- Entropy of a random tokenmedium
- Template built from user textmedium
- Newlines in a redirect headermedium
- Export opens with a formulamedium
- WebSocket accepts any originmedium
- Sending a token with postMessagemedium
- Token from another service acceptedmedium
- Attacker stays logged inmedium
- Storing card detailsmedium
- What helmet adds to Expressmedium
- Next.js Server Action without a checkmedium
- Serving user-uploaded HTMLmedium
- Private invoice downloads from S3medium
- Valid webhook sent twicemedium
- How long to guess a 4-digit PINmedium
- Package name with one letter offmedium
- Install scripts in CImedium
- Fake lines in the audit logmedium
- Removed admin still has accessmedium
Hard 48
- Refresh token rotationhard
- Module variable holds the current userhard
- JWT algorithm confusionhard
- Redirect check that can be bypassedhard
- Link previews fetch internal URLshard
- Nonce-based CSP trade-offhard
- Comparing secret tokens safelyhard
- Designing password reset linkshard
- Blocking secrets from reaching the clienthard
- Safe data for client componentshard
- CSRF protection for Server Actionshard
- Sanitised HTML changed afterwardshard
- What 'strict-dynamic' allowshard
- CSP that trusts a whole CDNhard
- SSRF check passes, request hits internal IPhard
- Safe URL that redirects insidehard
- Proxy and server disagree on body lengthhard
- CDN caches an attacker's script URLhard
- One-time coupon used five timeshard
- Why public clients use PKCEhard
- OAuth callback without statehard
- Username that attacks laterhard
- Extracting an uploaded ZIPhard
- JWT key chosen by the kid headerhard
- bcrypt and very long inputhard
- Cart accepts negative quantityhard
- Same nonce for every AES-GCM messagehard
- Signing with sha256(secret + message)hard
- Two framing headers disagreehard
- What COOP protectshard
- Different errors for bad paddinghard
- Access check only on the top fieldhard
- Where to keep a pepperhard
- SAML response with two assertionshard
- Lookalike usernamehard
- Duplicate query parametershard
- Profile cached as a .css filehard
- Sandbox with scripts and same-originhard
- Linking accounts by emailhard
- Login is slower for real usershard
- Token with alg set to nonehard
- Origin regex that is too loosehard
- Denylist misses another IP formathard
- Internal package pulled from the public registryhard
- Injected base tag beats a nonce CSPhard
- Invoice PDF renders attacker HTMLhard
- Double charge on retryhard
- Loose redirect_uri matchinghard