🚀 Web Development Interview Questions with Answers — Part 7: Web Security

🧠 151. What is HTTPS?

HTTPS stands for: 👉 HyperText Transfer Protocol Secure

It is the secure version of HTTP that encrypts data exchanged between browser and server.

Benefits:

✅ Secure communication

✅ Protects sensitive data

✅ Prevents eavesdropping

Example: https://example.com

🧠 152. Difference Between HTTP and HTTPS

Feature : HTTP : HTTPS

Security : Not secure : Secure

Data : Sent as plain text : Data encrypted

Port : Uses Port 80 : Uses Port 443

SSL/TLS : No SSL/TLS : Requires SSL/TLS

🧠 153. What is SSL/TLS?

SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are protocols that encrypt data transmission.

Benefits:

✅ Data encryption

✅ Authentication

✅ Data integrity

Example: When you see a padlock icon in the browser, SSL/TLS is being used.

🧠 154. What is XSS Attack?

XSS stands for: 👉 Cross-Site Scripting

It occurs when attackers inject malicious JavaScript into webpages.

Example:

<script>
alert("Hacked");
</script>

Prevention:

✅ Validate input

✅ Escape output

✅ Use Content Security Policy (CSP)

🧠 155. What is CSRF Attack?

CSRF stands for: 👉 Cross-Site Request Forgery

It tricks authenticated users into performing unwanted actions.

Example: A logged-in user unknowingly submits a bank transfer request.

Prevention:

✅ CSRF Tokens

✅ SameSite Cookies

✅ Authentication checks

🧠 156. What is SQL Injection?

SQL Injection occurs when malicious SQL code is inserted into queries.

Vulnerable Query:

SELECT * FROM users
WHERE username = 'admin'
AND password = '123';

Prevention:

✅ Prepared Statements

✅ Parameterized Queries

✅ Input Validation

🧠 157. How to Secure APIs?

Best Practices:

✅ Use HTTPS

✅ Authentication & Authorization

✅ Rate Limiting

✅ Input Validation

✅ API Keys

✅ JWT Tokens

Example: Authorization: Bearer <token>

🧠 158. What is Hashing?

Hashing converts data into a fixed-length value.

Example:

password123  
↓  
5e884898da...  

Uses: Password storage, Data verification

🧠 159. Difference Between Encryption and Hashing

Feature : Encryption : Hashing

Reversibility : Reversible : Irreversible

Key : Uses key : No key required

Purpose : Protects data : Verifies integrity

Example:

Encryption → Credit card data

Hashing → Passwords

🧠 160. What is bcrypt?

bcrypt is a password hashing algorithm.

Features:

✅ Salt generation

✅ Secure password storage

✅ Resistant to brute-force attacks

Example:

const hash = await bcrypt.hash(password, 10);

🧠 161. What is OAuth?

OAuth is an authorization framework that allows third-party applications to access resources without sharing passwords.

Examples: Login with Google, Login with GitHub, Login with Facebook

Benefits:

✅ Secure authentication

✅ No password sharing

🧠 162. What is JWT Token Security?

JWT (JSON Web Token) securely transmits user information.

Structure: Header.Payload.Signature

Security Tips:

✅ Short expiration time

✅ Use HTTPS

✅ Store securely

🧠 163. What is Content Security Policy (CSP)?

CSP is a browser security feature that helps prevent XSS attacks.

Example:

Content-Security-Policy: default-src 'self';