Networking/Security Interview Questions
20 Networking/Security interview questions with worked answers, complexity notes, and runnable code you can edit in the browser — ordered easy to hard so you build up steadily. Free, no signup. Open any question for the full answer.
How the web moves data, and how it defends users
This section joins two topics that live together in practice: how HTTP actually works, and how the browser’s security model protects people from a web where any page can talk to any server. Start with the protocol. An HTTP message is a start line, headers, and an optional body; methods and status codes carry meaning you are expected to use correctly (idempotency, the difference between 401 and 403, what 304 buys you). Caching and conditional requests are where real latency wins hide, and the protocol’s evolution — HTTP/1.1’s head-of-line blocking, HTTP/2’s multiplexing, HTTP/3 over QUIC — is a story about removing bottlenecks one layer at a time.
The security half starts from the same-origin policy: by default a page cannot read the response from another origin, and CORS is the server’s way of granting specific exceptions. Cookies, and the SameSite attribute, decide what rides along on cross-site requests, which is the crux of CSRF. TLS is what makes any of this trustworthy on a hostile network.
From there the questions cover the vulnerability classes every frontend engineer must reason about — XSS, CSRF, clickjacking, and supply-chain risk — alongside the layered defenses that contain them: context-aware escaping, a Content Security Policy, security headers, and Subresource Integrity. The hardest questions are design decisions: where to store auth tokens and why, the OAuth and OIDC authorization-code flow with PKCE, choosing a real-time transport, and building request handling that survives retries, rate limits, and flaky connections. The recurring lesson is defense in depth — no single header or escape saves you, and knowing why each layer exists is what the interview is checking.
Easy
- HTTP methods and status codes HTTP Basics
Walk through the common HTTP methods and status-code families. What does each convey? - Anatomy of an HTTP request and response HTTP Basics
Describe the parts of an HTTP request and response. What lives in the start line, headers, and body? - HTTPS and TLS: what encryption buys you Transport Security
What does HTTPS actually protect, and what does the TLS handshake establish? What does it NOT protect? - Cookie flags and session security Cookies & Sessions
You store a session id in a cookie. Which cookie attributes make it secure, and what does each defend against? - The same-origin policy Browser Security Model
What is the same-origin policy, what counts as an 'origin', and why does the web need it? - CORS and the preflight request Browser Security Model
What problem does CORS solve, and how does the preflight request work? Which headers matter? - Safe and idempotent methods: GET vs POST HTTP Semantics
What do 'safe' and 'idempotent' mean for HTTP methods, and why do these properties matter in practice? - Conditional requests: ETag, Last-Modified, and 304 Caching
How do conditional requests work? Explain ETag / If-None-Match and the 304 Not Modified response.
Medium
- Cross-site scripting (XSS): types and defenses Web Vulnerabilities
Explain the types of XSS and the layered defenses. Why is escaping context-dependent, and where does CSP fit? - CSRF: how it works and how to stop it Web Vulnerabilities
Explain a cross-site request forgery attack step by step, and the modern defenses. How does SameSite change the picture? - Authentication vs authorization; sessions vs tokens Authentication
Distinguish authentication from authorization, then compare session-cookie auth with token (JWT) auth. What are the trade-offs? - HTTP/1.1 vs HTTP/2 vs HTTP/3 Protocol Evolution
Compare HTTP/1.1, HTTP/2, and HTTP/3. What problem does each version solve, and what is head-of-line blocking? - DNS resolution and the request lifecycle Request Lifecycle
Trace what the network does when a browser needs to reach example.com: DNS resolution through the first bytes of the response. Where does…
Hard
- Content Security Policy in depth Security Headers
Design a Content Security Policy for a modern app. Explain nonces vs hashes, strict-dynamic, and common bypasses of weak policies. - Where to store auth tokens: cookies vs localStorage Token Storage
An SPA needs to keep the user logged in across reloads. Compare storing the token in localStorage vs an HttpOnly cookie. What's the secure… - OAuth 2.0 and OIDC: the authorization-code flow with PKCE Authentication
Explain the OAuth 2.0 authorization-code flow with PKCE and how OpenID Connect fits in. Why is PKCE required for SPAs and why is the… - Real-time transport: WebSockets vs SSE vs long-polling Real-time Transport
You need to push server updates to the browser. Compare long-polling, Server-Sent Events, and WebSockets. How do you choose? - Clickjacking and defensive security headers Security Headers
What is clickjacking, and which HTTP security headers should a production app set? Explain what each one does. - Subresource Integrity and third-party script risk Supply-chain Security
Your app loads a third-party script from a CDN. What's the supply-chain risk, how does Subresource Integrity help, and what are its limits? - Rate limiting, retries, and idempotency keys Resilience
Design the client/server contract for a flaky network: rate limiting (429), retries with backoff, and safe retries of non-idempotent…
Other topics
HTML/CSS · Browser · JavaScript · TypeScript · React · System Design · Accessibility · Web Performance · Testing · DSA