Application Security Interview Prep

Application security interview questions cover the OWASP top issues every senior backend engineer is expected to know — injection (SQL, command), broken authentication and session management, XSS and CSRF, insecure deserialization, dependency vulnerabilities (CVE triage, Log4Shell-grade incidents), secrets management, secure password storage (bcrypt/argon2), TLS basics, and the secure-by-default patterns in modern Spring Boot. Pair this with the Spring Security page for the auth-specific surface.

Defence in depth, with the OWASP Top 10 as the default threat catalogue:

• Injection — parameterised queries, prepared statements.
• AuthN / AuthZ — strong password storage (BCrypt / Argon2), least privilege.
• XSS / CSRF — output encoding, CSRF tokens for cookie auth.
• Crypto at rest + in transit — TLS 1.2+, AES-GCM.
• Dependencies — SCA (OWASP Dependency-Check, Snyk, Trivy).

The interview surface for this module breaks into these focus areas:

• Comparisons — drill the named patterns, the failure modes, and the recommended Java / framework idiom.
• Compliance — drill the named patterns, the failure modes, and the recommended Java / framework idiom.
• Encryption — drill the named patterns, the failure modes, and the recommended Java / framework idiom.
• Owasp top 10 — drill the named patterns, the failure modes, and the recommended Java / framework idiom.
• Secrets management — drill the named patterns, the failure modes, and the recommended Java / framework idiom.
• Secure coding — drill the named patterns, the failure modes, and the recommended Java / framework idiom.
• Security architecture — drill the named patterns, the failure modes, and the recommended Java / framework idiom.
• Security testing — drill the named patterns, the failure modes, and the recommended Java / framework idiom.
• Vulnerability scanning — drill the named patterns, the failure modes, and the recommended Java / framework idiom.
• Scenario-based — applied questions tying multiple topics together. Drill these last, after the fundamentals are sharp.

• Storing JWTs in localStorage = XSS-readable; httpOnly cookies are safer.
• Log4Shell-grade incidents — patch fast, mitigate by config when patch isn't possible.
• Secrets — never in code, never in env without a vault.
• CSRF on stateless APIs — disable; on cookie sessions — enable.
• CSP — most underused defence; even a basic policy stops most XSS classes.

"I'd treat input as hostile, parameterise every query, store passwords with BCrypt cost 12+, ship a CSP header, run SCA in CI, rotate secrets via vault, and review the OWASP Top 10 against the design before shipping."

Spring Security interview questions cover the auth layer that protects every modern Java backend — the SecurityFilterChain, authentication providers, password encoding, session vs stateless (JWT) auth, OAuth2 and OpenID Connect, method-level security (@PreAuthorize, @PostAuthorize), CORS and CSRF, and the common pitfalls interviewers love to surface (storing JWTs in localStorage, missing audit fields, leaking principal in logs). This page covers Spring Security with Spring Boot 3, including the modern config-by-bean style and the migration patterns from the older WebSecurityConfigurerAdapter approach.

Spring Security is a chain of filters, then method security on top:

• `SecurityFilterChain` — request-level rules, AuthN, session strategy.
• `AuthenticationManager` + providers — DAO, LDAP, OAuth2, JWT.
• Method security — @PreAuthorize, @PostAuthorize, SpEL.
• Cross-cutting — CORS, CSRF, headers, password encoders (BCryptPasswordEncoder).

Boot 3 / Security 6 dropped WebSecurityConfigurerAdapter; everything is now bean-style.

The interview surface for this module breaks into these focus areas:

• Authentication — drill the named patterns, the failure modes, and the recommended Java / framework idiom.
• Authorization — drill the named patterns, the failure modes, and the recommended Java / framework idiom.
• Comparisons — drill the named patterns, the failure modes, and the recommended Java / framework idiom.
• Cors and csrf — drill the named patterns, the failure modes, and the recommended Java / framework idiom.
• Jwt — drill the named patterns, the failure modes, and the recommended Java / framework idiom.
• Oauth2 — drill the named patterns, the failure modes, and the recommended Java / framework idiom.
• Security configuration — drill the named patterns, the failure modes, and the recommended Java / framework idiom.
• Security fundamentals — drill the named patterns, the failure modes, and the recommended Java / framework idiom.
• Sso and saml — drill the named patterns, the failure modes, and the recommended Java / framework idiom.
• Testing — drill the named patterns, the failure modes, and the recommended Java / framework idiom.
• Scenario-based — applied questions tying multiple topics together. Drill these last, after the fundamentals are sharp.

• Stateless JWT — no server session, signature verification on every request; never put secrets in the JWT.
• CSRF — disable on stateless APIs only; keep enabled for cookie-session apps.
• Password storage — BCrypt (default), Argon2 if you can afford the cost.
• Method security on `@Async` — context propagation needs DelegatingSecurityContextRunnable.
• OAuth2 — Resource Server vs Authorisation Server vs Client; name the role you're playing.

"I'd configure a `SecurityFilterChain` bean, route public/private paths explicitly, choose based on , encode passwords with BCrypt, and put method-level guards on the service. CSRF stays on for cookie auth, off for stateless JWT APIs."