NextJS Security Best Practices Flashcards

24 sample cards from the Security Best Practices deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. What is a salt in password hashing, and what attack does it defend against?

   A salt is a unique random value added to each password before hashing. It ensures identical passwords produce different hashes, defeating precomputed rainbow-table attacks and making bulk cracking harder.

2. Name three password-hashing algorithms designed to be deliberately slow/resource-intensive, and explain why slowness helps.

   bcrypt, scrypt, and Argon2. Their deliberate computational cost (work factor) slows brute-force and dictionary attacks by limiting how many guesses an attacker can compute per second.

3. In Next.js, why should secrets like database URLs and API keys use environment variables WITHOUT the NEXT_PUBLIC_ prefix?

   Variables prefixed with NEXT_PUBLIC_ are inlined into the client bundle and exposed to the browser. Secrets must omit that prefix so they remain server-only and are never shipped to the client.

4. What is the difference between encryption at rest and encryption in transit?

   Encryption at rest protects stored data (e.g. database/disk encryption) from attackers who gain storage access. Encryption in transit protects data moving over a network (e.g. via TLS/HTTPS) from interception/eavesdropping.

5. What is data minimization and why is it a security best practice for handling sensitive data?

   It is the practice of collecting, processing, and retaining only the data strictly necessary for a purpose. Less stored sensitive data means a smaller attack surface and reduced impact if a breach occurs.

6. What does HTTPS provide over HTTP, in terms of the CIA security properties?

   HTTPS layers TLS over HTTP to provide confidentiality (encryption of traffic), integrity (detection of tampering), and authentication (verifying the server's identity via its certificate).

7. What protocol underlies HTTPS today, and what replaced the older SSL?

   TLS (Transport Layer Security) underlies HTTPS. TLS replaced the deprecated SSL protocol; modern deployments use TLS 1.2 or TLS 1.3.

8. During a TLS handshake, how are asymmetric and symmetric cryptography combined?

   Asymmetric cryptography is used to authenticate the server and securely agree on a shared secret (key exchange). That shared secret then keys fast symmetric encryption for the bulk of the session data.

9. What is the HTTP Strict-Transport-Security (HSTS) header and what does it enforce?

   It is a response header (Strict-Transport-Security) that instructs browsers to only connect to the site over HTTPS for a specified max-age, preventing protocol-downgrade and SSL-stripping man-in-the-middle attacks.

10. What does a TLS/SSL certificate authority (CA) do, and why does it matter for HTTPS trust?

    A CA is a trusted third party that verifies a domain owner's identity and issues a signed certificate. Browsers trust certificates chaining to a known CA, which is how they confirm they are talking to the genuine server and not an impostor.

11. What is a security audit in the context of application security?

    A systematic review of an application's code, configuration, dependencies, and infrastructure against security standards to identify vulnerabilities, misconfigurations, and compliance gaps, producing findings and remediation recommendations.

12. Contrast static application security testing (SAST) with dynamic application security testing (DAST).

    SAST analyzes source code/binaries without executing them to find flaws early (white-box). DAST tests the running application from the outside by sending requests to find runtime vulnerabilities (black-box).

13. What is penetration testing and how does it differ from a routine vulnerability scan?

    Penetration testing is an authorized simulated attack where testers actively exploit weaknesses to demonstrate real impact. A vulnerability scan merely automatically enumerates known potential weaknesses without exploiting them.

14. Why are regular (recurring) security audits important rather than a single one-time review?

    Because code, dependencies, threats, and configurations continually change; new vulnerabilities are disclosed over time. Recurring audits catch regressions and newly introduced or newly discovered flaws that a one-time review would miss.

15. What is the purpose of maintaining audit logs, and what should they capture for security?

    Audit logs create a tamper-evident record of who did what and when, supporting incident detection, forensics, and accountability. They should capture authentication events, authorization decisions, and access to sensitive resources with timestamps and actor identities.

16. What does the Content-Security-Policy (CSP) header do, and which major attack class does it mitigate?

    CSP restricts which sources the browser may load scripts, styles, images, etc. from. It primarily mitigates cross-site scripting (XSS) by blocking execution of unauthorized/inline scripts.

17. What is the purpose of the X-Content-Type-Options: nosniff header?

    It tells the browser not to MIME-sniff a response away from its declared Content-Type, preventing attackers from getting content interpreted as an executable script when it was served as another type.

18. What does the X-Frame-Options (or CSP frame-ancestors) header protect against?

    It controls whether the site can be embedded in an iframe, defending against clickjacking attacks where a malicious site frames your page and tricks users into unintended clicks.

19. How can you set global security headers in a Next.js application?

    By defining a headers() function in next.config.js that returns header key/value pairs for matching source paths (e.g. adding CSP, HSTS, X-Content-Type-Options), or by setting them in middleware for dynamic responses.

20. What is Cross-Origin Resource Sharing (CORS) and why should it be configured restrictively?

    CORS is a browser mechanism using response headers (e.g. Access-Control-Allow-Origin) to control which origins may read cross-origin responses. It should be restricted to trusted origins so untrusted sites cannot make authenticated cross-origin requests to your API.

21. What is a supply-chain attack in the context of dependency management, and give an example vector.

    An attack that compromises software through its third-party dependencies rather than the app's own code. Example vectors: a maintainer publishing a malicious package version, typosquatting a popular package name, or a hijacked/compromised npm account injecting malware.

22. What does the `npm audit` command do, and what is one of its limitations?

    It scans a project's dependency tree against a vulnerability advisory database and reports known vulnerable packages with severity and fix guidance. A limitation is that it only flags publicly known CVEs/advisories and may produce false positives or miss unreported/zero-day issues.

23. What is the purpose of a lockfile (e.g. package-lock.json) for dependency security?

    It pins the exact resolved versions and integrity hashes of every dependency, ensuring reproducible installs and preventing unexpected or tampered versions from being silently pulled in across environments.

24. In semantic versioning (MAJOR.MINOR.PATCH), what do the caret (^) and tilde (~) range specifiers allow, and why does this matter for security?

    The caret (^1.2.3) allows updates that do not change the leftmost non-zero digit (minor and patch). The tilde (~1.2.3) allows only patch updates. This matters because loose ranges can pull in a newly published malicious minor/patch version, so pinning plus a lockfile reduces that risk.

What this deck covers

Security Best Practices flashcards FAQ