Question 1

How do symmetric (HS256) and asymmetric (RS256) signing algorithms differ for JWTs in Node.js?

Accepted Answer

HS256 uses the same shared secret to sign and verify, while RS256 uses a private key to sign and a public key, which can be shared, to verify.

Question 2

How do you implement Refresh Token Rotation and secure storage in cookies?

Accepted Answer

Store the Refresh Token in a Cookie protected by HttpOnly and SameSite; each use invalidates the current token and creates a new pair, and reuse of a revoked token invalidates the user's entire token family.

Question 3

Why should you never use SHA-256 functions to hash passwords, and why are Argon2 or bcrypt preferred?

Accepted Answer

SHA functions are fast and designed for general-purpose hashing, making billions of GPU guesses practical; bcrypt and Argon2 are deliberately slow and resistant to GPU and memory attacks.

Question 4

How do Cross-Site Request Forgery (CSRF) attacks work, and how do you protect Node.js applications from them?

Accepted Answer

They occur when a malicious site tricks a victim's browser into sending your site an unauthorized request with the victim's cookies; protection includes a CSRF Token and SameSite=Lax/Strict.

Question 5

What is Cross-Origin Resource Sharing (CORS), and what are Preflight Requests?

Accepted Answer

CORS is a browser security mechanism that prevents external sites from reading your data; a Preflight is an OPTIONS request the browser sends before the actual request to check whether it is allowed.

Question 6

What is the Helmet package, and which essential security headers does it add to a Node.js application?

Accepted Answer

It is middleware that adds standard security headers such as Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options, and hides the X-Powered-By header.

Question 7

What is JavaScript Prototype Pollution, and how do you avoid it in Node.js?

Accepted Answer

It is a vulnerability that lets an attacker inject malicious properties into the shared Object.prototype through deeply merged objects containing __proto__, changing application behavior.

Question 8

How do you manage environment variables and Secrets safely in Node.js projects?

Accepted Answer

Store them in system environment variables (process.env) instead of source code or Git, and validate that they exist at startup with a strict schema.

Question 9

What are Timing Attacks, and why should crypto.timingSafeEqual be used to compare sensitive tokens?

Accepted Answer

These attacks measure the server's response time in nanoseconds to infer how many characters matched before failure; timingSafeEqual prevents this by comparing bytes in constant time.

Question 10

How do you protect a Node.js project from Supply Chain Attacks in the npm ecosystem?

Accepted Answer

Use npm audit, pin exact versions, enable --ignore-scripts, scan dependencies with static analysis tools, and rely on a trusted lockfile.