Question 1

How does HTML contribute to XSS defense?

Accepted Answer

Escape untrusted text, use textContent, sanitize HTML, avoid dangerous sinks. Framework auto-escaping helps but bypasses exist (href javascript:, style, nested contexts).

Question 2

Why is target=_blank a security concern?

Accepted Answer

Opened pages can access window.opener unless rel=noopener (and often noreferrer). Modern browsers mitigate more, but still set rel. Phishing via tabnabbing historically mattered.

Question 3

What does the sandbox attribute on iframes do?

Accepted Answer

Restricts iframe capabilities (scripts, forms, top-nav) via allow-flags. Default sandbox is strict. Add permissions sparingly. Combine with CSP where possible.

Question 4

Explain Content-Security-Policy at a high level for HTML apps.

Accepted Answer

HTTP header (or meta) whitelisting sources for scripts, styles, images, etc. script-src matters most for XSS. Nonces/hashes beat unsafe-inline. Report-Only for rollout.

Question 5

Why is inline event handlers (onclick=) risky?

Accepted Answer

Mixes code into markup and often conflicts with CSP; harder to audit. Use addEventListener. CSP may block inline handlers without unsafe-inline/hashes.

Question 6

How do you safely embed user-generated HTML?

Accepted Answer

Sanitize with a vetted library allowlist; never regex-strip tags alone. Consider markdown → sanitized HTML. Escape by default; rich text is an explicit privilege.

Question 7

What are dangerous URL schemes in href/src?

Accepted Answer

javascript: and data: in navigable contexts can execute or exfiltrate. Validate/sanitize URLs. Prefer https:. Be careful with user-supplied redirects.

Question 8

How does autocomplete=off relate to security?

Accepted Answer

Limited effect; browsers/password managers often ignore for login fields. Don't rely on it for secrets. Use proper password manager friendly attributes instead.

Question 9

What is referrer policy useful for?

Accepted Answer

Controls Referer leakage across navigations and subresources. no-referrer or strict-origin-when-cross-origin are common defaults for privacy.

Question 10

How can meta refresh be abused?

Accepted Answer

Open redirects / phishing-like redirects if attacker controls content. Prefer HTTP redirects. Avoid user-controlled refresh URLs.

Question 11

Form security basics beyond HTTPS?

Accepted Answer

CSRF tokens for cookie sessions, server validation, rate limits, SameSite cookies. HTML alone can't secure forms — backend contracts matter. Autocomplete for passwords correctly.

Question 12

How do you threat-model a rich text comment feature?

Accepted Answer

XSS via HTML, stored payloads, admin-view escalation, CSP bypasses, SVG/math vectors. Sanitize on output, CSP, HttpOnly cookies, privilege separation for preview vs publish.

Security HTML Interview Questions

Other HTML interview topics