Security Fundamentals
The defaults you are expected to know without being asked.
Questions
Easy / Med / Hard
Your accuracy
Security rarely gets its own interview, and it comes up inside every design one. These are the defaults you should reach for without prompting.
Authentication vs authorisation. Authentication establishes who you are; authorisation decides what you may do. They map to HTTP status codes: 401 means we do not know who you are, 403 means we know and you still may not. Confusing the two is the most common mistake in this area.
Sessions vs tokens. A server-side session is trivially revocable — delete the row — but needs a shared store. A JWT is stateless and scales beautifully, and cannot be revoked before it expires without reintroducing exactly the store you were avoiding. The usual compromise is short-lived access tokens plus a revocable refresh token.
Storing passwords. Never plaintext, never a fast hash. MD5 and SHA-256 are designed to be fast, which is the opposite of what you want — use bcrypt, scrypt, or Argon2, which are deliberately slow and salted per user so a leaked database cannot be attacked with precomputed tables.
Injection is a parameterisation problem, not an escaping problem. Parameterised queries keep data and code separate so input can never become SQL. Hand-rolled escaping is a losing game. The same logic applies to output: XSS is prevented by encoding on output plus a Content Security Policy, not by trying to sanitise every input.
Least privilege, everywhere. Every credential, service account, and token should have the narrowest scope and shortest life that does the job. A read-only replica credential cannot drop your tables.
Two patterns worth naming. The valet key hands the client a scoped, time-limited credential to talk directly to a resource — a presigned upload URL is exactly this. The gatekeeper puts a hardened broker in front of a service so untrusted input is validated before it reaches anything that matters.
Secrets never live in source control. Environment variables at minimum, a managed secret store when you can, and rotation when one leaks — which you should assume will happen.