Question 1

What is prototype pollution and how does it show up in Node?

Accepted Answer

Merging untrusted objects into {} can alter Object.prototype if __proto__ is honored. Use safe merge libs, Object.create(null), and freeze critical objects. Validate JSON. Patch outdated deps.

Question 2

How do you prevent SSRF in a Node URL-fetching feature?

Accepted Answer

Allowlist schemes/hosts, block link-local/metadata IPs, resolve DNS carefully, and don't follow redirects blindly. Cloud metadata endpoints (169.254.169.254) are classic targets. Parse URLs correctly — don't blacklist naively.

Question 3

child_process with user input — safe patterns?

Accepted Answer

Avoid shell; use execFile/spawn with arg arrays; allowlist commands; never concatenate untrusted strings into shells. Shell injection is still common. Prefer no user-controlled commands at all.

Question 4

Dependency supply-chain hardening for Node?

Accepted Answer

Lockfiles, npm audit/OSV in CI, pinned versions, ignore scripts when possible, and review install hooks. Use private registries for critical orgs. Monitor for typosquatting. Reproducible builds matter.

Question 5

Helmet and security headers — enough?

Accepted Answer

Necessary baseline (CSP, HSTS, etc.) but not sufficient alone — authz, validation, and XSS sinks still matter. CSP design is hard with third-party scripts. Headers complement secure coding, not replace it.

Question 6

Lead: threat model a public Node API gateway.

Accepted Answer

Enumerate STRIDE, trust boundaries, abuse cases (bots, SSRF, auth bypass), logging/PII, and WAF/rate-limit layers. Prioritize fixes by risk. Red-team auth and tenancy. Make security reviews part of architecture gates.

Security Node.js Interview Questions

Other Node.js interview topics