Middle Auth & Security Interview Questions (50 MCQs)

Question 1

What is the key measure to prevent session fixation?

Accepted Answer

Issuing a new session ID immediately after successful login

Answer

Increasing session ID length to 256 bits

Answer

Storing the session in localStorage instead of a cookie

Answer

Encrypting the session ID with AES

Question 2

With `SameSite=Lax`, which cross-site request still sends the cookie?

Accepted Answer

A top-level GET navigation, like clicking a link

Answer

A POST form submission from another site

Answer

A `fetch` request from another site

Answer

Loading an image from another site via `<img>`

Question 3

Why isn't `SameSite` alone always a complete CSRF defense?

Accepted Answer

Subdomains of the same site (e.g. a vulnerable one) count as same-site

Answer

`SameSite` only works over HTTP, not HTTPS

Answer

`SameSite` blocks all GET requests

Answer

`SameSite` disables `HttpOnly`

Question 4

How does the double-submit cookie pattern for CSRF work?

Accepted Answer

A random value is sent in both a cookie and a header/form field, and the server checks they match

Answer

The cookie is sent twice per request for confirmation

Answer

The user must submit the form twice

Answer

Two cookies with different `SameSite` values are set

Question 5

What is the main advantage of RS256 over HS256 in a microservice architecture?

Accepted Answer

Services verify with the public key only and cannot forge tokens

Answer

RS256 encrypts the payload while HS256 does not

Answer

RS256 is faster than HS256

Answer

RS256 doesn't need an `exp` claim

Question 6

How does the JWT `alg: none` attack work and how is it prevented?

Accepted Answer

Attacker strips the signature and sets `alg` to `none`; pin allowed algorithms in verify

Answer

Attacker removes `exp`; encrypt the token to prevent it

Answer

Attacker deletes the header; use cookies instead

Answer

Attacker swaps the public key; switch to HS256

Question 7

Why should an API validate the `aud` and `iss` claims of a JWT?

Accepted Answer

So tokens issued for another service or by another issuer are rejected

Answer

To compute the token's expiration time

Answer

To decrypt the payload

Answer

To reduce token size

Question 8

What's the main problem with long-lived stateless JWTs?

Accepted Answer

They can't easily be revoked before they expire

Answer

They are no larger than a session ID

Answer

They only work in Chrome

Answer

They can't contain custom claims

Question 9

Why use a short-lived access token together with a refresh token?

Accepted Answer

Limit the abuse window of a stolen access token without forcing frequent logins

Answer

The refresh token replaces the user's password in the DB

Answer

Access token is for GET, refresh token for POST

Answer

So that HTTPS isn't needed

Question 10

How does refresh token rotation with reuse detection protect against token theft?

Accepted Answer

Each refresh issues a new token; if an old one is reused the whole token family is revoked

Answer

The refresh token is re-encrypted in the browser every hour

Answer

The refresh token is replaced by the user's IP

Answer

The refresh token can only be used once per day

Question 11

For an SPA, which refresh token storage is more resistant to XSS?

Accepted Answer

A cookie with `HttpOnly`, `Secure`, and an appropriate `SameSite`

Answer

`localStorage`, since it's shared across tabs

Answer

`sessionStorage`, since it clears when the tab closes

Answer

A global variable on `window`

Question 12

In the Authorization Code flow, why is a code returned to the redirect URI instead of a token?

Accepted Answer

So the token is exchanged over a secure back channel and doesn't leak via URL or browser history

Answer

Because tokens are too long to fit in a URL

Answer

Because the code is the refresh token

Answer

To remove the need for HTTPS

Question 13

Which attack does PKCE prevent in OAuth 2.0?

Accepted Answer

Interception of the authorization code and its exchange by an attacker

Answer

XSS on the consent page

Answer

SQL injection in the authorization server

Answer

Brute-forcing the user's password

Question 14

Why is the Implicit flow deprecated in the OAuth 2.0 Security BCP?

Accepted Answer

The access token is returned in the URL fragment, exposing it to leakage and injection

Answer

Because it doesn't support HTTPS

Answer

Because it requires a client secret SPAs don't have

Answer

Because it was designed only for mobile apps

Question 15

Which OAuth grant suits service-to-service communication with no user involved?

Accepted Answer

Client Credentials

Answer

Authorization Code + PKCE

Answer

Resource Owner Password Credentials

Answer

Implicit

Question 16

What is the `state` parameter in an OAuth authorization request for?

Accepted Answer

Preventing CSRF on the callback by binding the response to the user's session

Answer

Specifying requested scopes

Answer

Holding the access token between requests

Answer

Setting the login page language

Question 17

How should an authorization server validate `redirect_uri`?

Accepted Answer

Exact string match against pre-registered URIs

Answer

Only check that it starts with `https://`

Answer

Prefix matching the domain with wildcards

Answer

Accept any URI the client sends

Question 18

Why shouldn't an ID token be sent to an API as an access token?

Accepted Answer

The ID token is meant for the client (with `aud` = client_id), not for authorizing API access

Answer

ID tokens are always encrypted and APIs can't read them

Answer

ID tokens aren't JWTs

Answer

ID tokens are valid for only 1 second

Question 19

What does the `nonce` parameter in OpenID Connect protect against?

Accepted Answer

Replay of an old or injected ID token

Answer

Brute-forcing the client secret

Answer

XSS in the redirect URI

Answer

Refresh token expiry

Question 20

In SAML SSO, how does the IdP convey the user's identity to the Service Provider?

Accepted Answer

A signed XML SAML Assertion

Answer

An HS256-signed JWT

Answer

A cookie shared across both domains

Answer

Forwarding the user's password to the SP

Question 21

Why are passkeys (WebAuthn) phishing-resistant?

Accepted Answer

The credential is bound to the site's origin and the browser won't use it on a fake domain

Answer

Because a passkey is just a very long password

Answer

Because the passkey is sent via SMS

Answer

Because the server stores the user's private key

Question 22

What is the main weakness of SMS as a second factor?

Accepted Answer

Vulnerability to SIM swapping, interception, and phishing

Answer

SMS codes are always guessable

Answer

SMS requires an internet connection

Answer

SMS is incompatible with HTTPS

Question 23

What does mTLS add compared to regular TLS?

Accepted Answer

The client also authenticates to the server with its own certificate

Answer

Double encryption with two AES keys

Answer

Removing the need for a server certificate

Answer

Support for HTTP/1.0

Question 24

'A doctor may access only their department's patient records, only during working hours' is best modeled with which approach?

Accepted Answer

ABAC (based on user, resource, and environment attributes)

Answer

Plain RBAC with a single `doctor` role

Answer

A static ACL on each file

Answer

A separate API key per department

Question 25

What kind of rules is ReBAC (like Google Zanzibar) suited for?

Accepted Answer

Relationship-based rules, like 'members of the team owning the folder can edit the doc'

Answer

Restricting access by IP address

Answer

Per-user rate limiting

Answer

Encrypting data by role

Question 26

What's the risk of `User.update(req.params.id, req.body)` in a profile update endpoint?

Accepted Answer

Mass assignment; the user can set fields like `isAdmin` or `role`

Answer

Guaranteed SQL injection in every ORM

Answer

XSS because the body is JSON

Answer

CSRF because `req.params` is used

Question 27

In MongoDB, what happens with `users.findOne({ email: req.body.email, password: req.body.password })` given the body `{"email":"a@b.c","password":{"$ne":null}}`?

Accepted Answer

The `$ne` operator bypasses the password check, allowing login without it

Answer

MongoDB errors out because the password isn't a string

Answer

It only matches a user whose password is `null`

Answer

No effect, since MongoDB has no SQL

Question 28

An 'import image from URL' feature fetches `http://169.254.169.254/latest/meta-data/`. What attack is this and why is it dangerous?

Accepted Answer

SSRF; cloud IAM credentials may leak from the metadata endpoint

Answer

XSS; the image can run scripts

Answer

CSRF; the request carries the user's cookie

Answer

Open redirect; the user is sent to another site

Question 29

Which Content-Security-Policy provides the strongest XSS protection?

Accepted Answer

`script-src 'nonce-r4nd0m' 'strict-dynamic'; object-src 'none'; base-uri 'none'`

Answer

`script-src 'self' 'unsafe-inline' 'unsafe-eval'`

Answer

`script-src *`

Answer

`default-src 'self' https:`

Question 30

Why isn't HTML-escaping enough when placing input into `<a href="...">`?

Accepted Answer

A URL like `javascript:alert(1)` has no HTML special chars yet executes; validate the scheme

Answer

Because browsers ignore escaping inside attributes

Answer

Because `href` only accepts Base64

Answer

Because escaping breaks the link

Question 31

A server reflects the request's Origin into `Access-Control-Allow-Origin` unchecked and also sends `Access-Control-Allow-Credentials: true`. What's the result?

Accepted Answer

Any site can make credentialed requests and read the responses

Answer

The browser blocks all requests

Answer

Only same-origin requests are allowed

Answer

No effect, since CORS applies only to GET

Question 32

Which statement about CORS is correct?

Accepted Answer

CORS is a browser policy for reading responses and doesn't replace server-side authentication

Answer

CORS blocks curl requests to the API

Answer

CORS encrypts data in transit

Answer

CORS prevents all CSRF attacks

Question 33

Why can comparing an API token or HMAC with `===` be insecure?

Accepted Answer

It stops at the first differing character, so response time leaks information

Answer

`===` throws on long strings in JavaScript

Answer

`===` is case-insensitive

Answer

`===` writes the string to logs

Question 34

What's the correct way to verify an HMAC-signed webhook (like Stripe or GitHub)?

Accepted Answer

Compute the HMAC over the raw body with the shared secret, compare in constant time, and check the timestamp

Answer

Parse the JSON and compute the HMAC over its `JSON.stringify`

Answer

Only check the sender's IP

Answer

Base64-decode the signature and compare it to the secret

Question 35

Why use `HMAC-SHA256(key, msg)` instead of `SHA256(key + msg)` to sign messages?

Accepted Answer

`SHA256(key + msg)` is vulnerable to length extension attacks

Answer

HMAC produces shorter output

Answer

HMAC is reversible, so the message can be recovered

Answer

SHA256 only works on files

Question 36

What is a pepper in password hashing and where is it kept?

Accepted Answer

A global secret stored outside the database (e.g. in an HSM or secrets manager)

Answer

A per-user random salt stored next to the hash

Answer

The number of bcrypt rounds

Answer

A second hash of the user's email

Question 37

Which bcrypt limitation must be considered when using it?

Accepted Answer

It only uses the first 72 bytes of the password

Answer

It can't hash passwords shorter than 16 characters

Answer

Its output is identical on every run

Answer

It requires a GPU to run

Question 38

How can you upgrade bcrypt cost or the hash algorithm without resetting user passwords?

Accepted Answer

On successful login, rehash the plaintext password with the new parameters and store it

Answer

Decrypt old hashes and rehash them with the new algorithm

Answer

Brute-force all hashes in a nightly script

Answer

It's impossible; everyone must change their password

Question 39

What's the problem with hard-locking an account after 5 failed attempts?

Accepted Answer

Attackers can deliberately lock out other users (DoS)

Answer

Locking leaks the password hash

Answer

Locking stops credential stuffing even better

Answer

No problem; it's the best practice

Question 40

What properties should a password reset link token have?

Accepted Answer

High-entropy random, single-use, short-lived, and stored hashed in the DB

Answer

The Base64 of the user's email for easy verification

Answer

A sequential incrementing number per request

Answer

Permanent so the user can use it anytime

Question 41

What's the main advantage of a secrets manager (e.g. HashiCorp Vault or AWS Secrets Manager) over static env vars?

Accepted Answer

Access control, audit logs, automatic rotation, and even dynamic short-lived secrets

Answer

Faster application runtime

Answer

Removing the need for TLS

Answer

Allowing secrets to be committed to Git

Question 42

Which is an example of security misconfiguration?

Accepted Answer

Showing full stack traces and framework versions in production error responses

Answer

Using Argon2id for passwords

Answer

Having HSTS enabled

Answer

Using parameterized queries

Question 43

Which should NOT be written to application logs?

Accepted Answer

Passwords, access tokens, and the full `Authorization` header

Answer

User ID and login time

Answer

Response status code

Answer

A request ID for tracing

Question 44

What characterizes a good security audit log?

Accepted Answer

Records who did what to which resource, when, and from where; append-only and separate from the app

Answer

Logs only server 500 errors

Answer

Stored in a table the app can freely edit

Answer

Logs full request bodies including passwords

Question 45

Why is deserializing user input with Python's `pickle.loads` or Java's `ObjectInputStream` dangerous?

Accepted Answer

It can lead to remote code execution (RCE) via gadget chains

Answer

It only slows down processing

Answer

It only corrupts Unicode characters

Answer

It leaks cookies in the browser

Question 46

How should API keys issued to customers be stored in the database?

Accepted Answer

Only their hash (e.g. SHA-256) plus a displayable prefix for identification

Answer

In plaintext so they can be shown to the user again

Answer

Base64-encoded for extra security

Answer

With bcrypt at cost 20

Question 47

In a JWT-based system, how is a real server-side logout achieved?

Accepted Answer

Revoke the refresh token and, if needed, denylist the access token's `jti` until expiry

Answer

Just delete the token from client localStorage

Answer

Modify the token's `exp` claim

Answer

Resend the same token to a logout endpoint

Question 48

Why use `npm ci` instead of `npm install` in CI?

Accepted Answer

It installs exactly the lockfile's versions and integrity hashes, failing on mismatch

Answer

It always installs the latest package versions

Answer

It encrypts `postinstall` scripts

Answer

It patches vulnerabilities automatically

Question 49

In the token bucket rate-limiting algorithm, what allows short bursts?

Accepted Answer

The bucket capacity; tokens accumulated up to the cap can be spent at once

Answer

The refill rate, which increases during bursts

Answer

Clearing the bucket at the start of each minute

Answer

Queueing all requests until the bucket empties

Question 50

Which header prevents clickjacking?

Accepted Answer

`Content-Security-Policy: frame-ancestors 'none'` (or `X-Frame-Options: DENY`)

Answer

`X-Content-Type-Options: nosniff`

Answer

`Referrer-Policy: no-referrer`

Answer

`Cache-Control: no-store`