Loading
Pick a focused question that fits your time, stack, and interview goal.
16 results across 1 active filter
Page 1 of 1
Partitions limits by authenticated user or trusted client address and returns useful 429 retry metadata.
Explains rate-limit identity, endpoint cost, login and suggestion throttles, Redis counters, user experience, and observability.
Loads a resource once, evaluates owner-or-capability authorization, and avoids trusting route ownership claims.
Explains when CSRF matters, how cookies change browser behavior, and what mitigations fit API clients.
Explains what CORS controls, what it does not protect, and why APIs still need authentication and authorization.
Validates size and signature, writes under a generated storage key, and keeps untrusted files outside the public web root.
Verifies the exact request bytes, rejects stale signatures, deduplicates event ids, and queues processing durably.
Explains insecure direct object reference risks and how APIs enforce ownership, tenant scope, and authorization per resource.
Explains why request DTOs should expose only allowed fields and how server-owned fields stay protected.
Updates only public mutable fields and leaves ownership, status, and audit values server-controlled.
Secures webhooks, previews, imports, and remote-file fetches with destination policy, DNS and redirect defenses, egress controls, limits, and observability.
Maps a named capability to an ASP.NET Core policy and enforces it at the endpoint boundary.
Explains token storage, cookies, XSS, CSRF, and why browser UI never replaces server authorization.
Explains where secrets and tokens should live, what not to log, how rotation works, and how client storage changes risk.
Explains safe error responses for auth failures, validation failures, server errors, and sensitive resource access.
Explains HTTPS, HSTS, secure cookies, HttpOnly, SameSite, no-store, and practical API/browser security hardening.