✅ Web development Interview Questions with Answers Part-9

81. What is XSS and how do you prevent it?
XSS happens when malicious scripts run in the browser. It usually comes from unescaped user input. I prevent it by escaping output. I avoid innerHTML. I use content security policy.

82. What is CSRF and how do you protect against it?
CSRF forces users to perform unwanted actions. It exploits trusted sessions. I use CSRF tokens. I use same-site cookies. I verify request origin.

83. Why is HTTPS important and how does TLS work?
HTTPS encrypts data in transit. TLS handles encryption and key exchange. It prevents man-in-the-middle attacks. It ensures data integrity.

84. How should passwords be stored securely?
Passwords are never stored in plain text. I hash them using bcrypt or argon2. I use salt. I apply proper hashing cost.

85. Why should environment variables be used for secrets?
They keep secrets out of source code. They differ per environment. They reduce accidental exposure in repositories.

86. What are secure HTTP headers?
They protect against common attacks. Examples include CSP, HSTS, X-Frame-Options. I configure them at server or proxy level.

87. What are common OWASP security risks?
Injection attacks. XSS. Broken authentication. Sensitive data exposure. I follow OWASP guidelines during development.

88. What is role-based access control?
RBAC restricts access based on roles. Permissions are tied to roles, not users. It simplifies access management.

89. How do you sanitize user input?
I validate input type and length. I escape output. I use libraries instead of manual parsing.

90. How do you securely store uploaded files?
I validate file content. I change file names. I restrict execution. I store files outside public folders.

Double Tap ♥️ For Part-10