Full-stack Developer interview question
How do you secure a full-stack application?
Secure every boundary: validate untrusted input, authenticate securely, authorize server-side, protect sessions and CSRF, encode output, use parameterized queries, manage secrets outside code, and patch dependencies from a threat model.
Direct answer
What a strong answer covers
How it works
Security is applied at every boundary because each one is attacked differently. In the browser: escape output to stop XSS, set a content security policy, use HttpOnly and SameSite cookies, and protect state-changing requests from CSRF. At the API: validate every input against a schema, authenticate with well-tested libraries, authorise per resource on the server, rate-limit, and bound payload sizes. At the data layer: parameterised queries, least-privilege database roles, and encryption of sensitive columns. Secrets live in a vault and never in the repository, dependencies are scanned and updated, and a threat model decides which of the remaining risks matter most.
Example
A comment feature renders user text through the framework’s escaping and a CSP that blocks inline scripts, the POST endpoint validates length and type with a schema and checks that the user may comment on that thread, the query uses bound parameters, and the session cookie is HttpOnly, Secure, and SameSite=Lax. A dependency alert for the markdown parser is patched the same week because the threat model rates rendered user content as high exposure.
Common mistakes
- Relying on frontend validation and skipping it on the server.
- Building string SQL from request parameters.
- Committing an API key to the repository and rotating it only after a leak.
A useful answer structure
Answer from your own work.
Do not memorise a script: use only examples you can explain honestly in follow-up questions.
Open the desktop workspace and rehearse a clear answer in your own words.