Engrain by ByteRush

QLT.05 7 concepts · 1 ready

Web security

Prevent the common web vulnerabilities and explain them in interviews.

  1. QLT.05.01Threat model and the OWASP Top 10 for frontendCoreMid-level12 min
  2. QLT.05.02XSS: types and preventionCoreMid-levelBeing written
  3. QLT.05.03Content Security Policy and security headersCoreMid-levelBeing written
  4. QLT.05.04CSRF and cookie securityCoreMid-levelBeing written
  5. QLT.05.05Authentication: sessions, tokens, OAuth, OIDC, passkeysCoreMid-levelBeing written
  6. QLT.05.06Supply chain and dependency securityMid-levelBeing written
  7. QLT.05.07Privacy and data protectionMid-levelBeing written

Interview questions in this module

  1. Explain XSS. How does React protect you and where can you still be vulnerable?
  2. What is a Content Security Policy? How would you roll one out?
  3. Explain CSRF and how to prevent it. Does SameSite solve it fully?
  4. Where should you store JWTs in a browser app? Trade-offs?
  5. Explain the OAuth 2.0 authorization code flow with PKCE.
  6. What are passkeys and why are they phishing-resistant?
  7. What is clickjacking?
  8. How do you protect a frontend from compromised npm packages?
  9. What is Subresource Integrity?
  10. What security headers would you set on a new app?