Security / SQL Injection Interview Questions 2026

A rate limiting mechanism blocks requests after 100/minute. An attacker sends 99 requests/minute from 1000 different IPs. Your rate limiter doesn't catch this. What type of attack is this and how do you mitigate it?

How do you securely store API keys that your application needs to call third-party services? Compare 4 approaches.

Explain how OAuth 2.0 authorization code flow works. Why is it more secure than the implicit flow?

You find a log file containing plaintext credit card numbers. What immediate steps do you take and in what order?

Explain CORS. A developer disables CORS entirely with Access-Control-Allow-Origin: * on your API. Why is this a security risk for some endpoints?

Your API returns user data based on a user ID in the URL: GET /api/users/123/profile. A user changes 123 to 124 and sees someone else's profile. What vulnerability is this and how do you fix it?

Explain what HTTPS does and does NOT protect against.

What is a timing attack and how do you prevent it in a password comparison function?

Your application logs show someone is trying thousands of username/password combinations per second. How do you stop this?

A user reports they can see another user's data by changing the ID in the URL: /api/orders/123 → /api/orders/124. What vulnerability is this?

Your JWT tokens are being stolen from localStorage and used in attacks. A developer suggests using httpOnly cookies instead. Describe the complete migration, including risks and security tradeoffs.

Explain OWASP Top 10 in 2023. Pick 3 and explain how to defend against them with code examples.

You discover a reflected XSS vulnerability in your React application despite React's automatic escaping. How is this possible in React?

Your company stores user passwords as MD5 hashes. A developer says 'MD5 is fine because we also add a salt.' Is he right? Explain the actual risk and the correct solution.

Your API returns different error messages for valid vs invalid usernames during login (e.g., 'Wrong password' vs 'User not found'). Why is this a security vulnerability and how do you fix it?

A security audit finds that your Node.js API is vulnerable to SQL injection despite using parameterized queries everywhere. How is this possible?

What is the difference between authentication and authorization? Give examples of getting each wrong.

Explain idempotency keys in a payments API. What specific failure mode do they prevent, and how would you design the storage layer for them so they don't become a bottleneck?

A user says they can log in to your app as another user by changing a value in their session cookie. How serious is this and what's your immediate response?

Explain the difference between OAuth 2.0 and OpenID Connect (OIDC). Which one should you use for login?

How do you prevent clickjacking and what is the X-Frame-Options header?

What is the difference between symmetric and asymmetric encryption? When would you use each in a web application?

How would you design API key storage so that even if your database is breached, attackers can't use the leaked keys directly?

What is SSRF (Server-Side Request Forgery) and give a real-world example of how it's exploited.

Explain the difference between role-based access control (RBAC) and attribute-based access control (ABAC). Give an example permission requirement that RBAC alone can't express cleanly.

Explain content security policy (CSP). How does it protect against XSS?

What is SQL injection and how do you prevent it in a Python Flask app that takes user search input?

In a shared-schema multi-tenant database, what specific bug pattern most commonly causes cross-tenant data leaks, and how do you prevent it at the code level, not just by convention?

A customer calls support at 2 AM. They say they can see another customer's order history when they click 'My Orders.' You're on call. Walk me through your incident response.

You join a company and find the main API has no authentication on 3 endpoints that return user PII. Your manager says 'it's legacy, we'll fix it later.' What do you do?

A junior developer on your team committed an API key to a public GitHub repository 3 days ago. What do you do?

What is the difference between authentication with sessions vs JWT? Security trade-offs?