Web Security
25 practice items · needed by 4 roles
Easy 6Medium 7Hard 12
Practice questions
- Fixing a CORS errormedium
- Where to keep a session tokenmedium
- Secret key with NEXT_PUBLIC_ prefixmedium
- Preventing XSS from user HTMLhard
- A CSP that stops injected scriptshard
- CSRF risk left with SameSite=Laxhard
- Unsafe postMessage listenerhard
- Browser blocks a call that curl allowseasy
- What HttpOnly does on a cookieeasy
- What HTTPS leaves visibleeasy
- Webhook signature never matchesmedium
- What HttpOnly doeseasy
- What HTTPS protectseasy
- Caching a bank statement pageeasy
- Users see each other’s profilemedium
- User bios rendered as HTMLmedium
- Module variable holds the current userhard
- JWT algorithm confusionhard
- Redirect check that can be bypassedhard
- Link previews fetch internal URLshard
- Nonce-based CSP trade-offhard
- Comparing secret tokens safelyhard
- Designing password reset linkshard
- Spot the attack in a web logmedium
- SSRF and cloud instance metadatahard