CS Fundamentals Trainer
Practise computer science fundamentals with interview questions, spaced repetition, timed tests and system design challenges you draw and get checked.
System design challenges
- Design a URL shortener like bit.ly
- Design photo uploads and viewing for an Instagram-like app
- Design the home timeline of a Twitter-like social network
- Design a one-to-one chat app like WhatsApp
- Design rate limiting for a public API
- Design a notification service that sends email, SMS and push messages
- Design live driver tracking for a ride-sharing app
- Design product search and checkout for an online shop
Questions
- Assigning the string '<script>alert(1)</script>' to an element's innerHTML runs the script.
- Which of these can execute an attacker-controlled string str as JavaScript?
- Which of these insert an untrusted string input into the DOM without it being parsed as HTML?
- A search page's server reads the q query parameter and writes it unescaped into the HTML response as You…
- A template HTML-escapes <, >, &, " and ', then renders a user-supplied profile link as <a href="{{url}}">.…
- Predict the output: an HTML-escaping helper with its replacements in this order.
- Predict the output: three ways to decide whether a link is safe to put in href.
- Put the steps of a stored XSS attack in order, first to last.
- A response carries Content-Security-Policy: script-src 'self' 'unsafe-inline' 'nonce-r4nd'. Which inline…
- A page is served with Content-Security-Policy: script-src 'nonce-r4nd' 'strict-dynamic' https://cdn.example.…
- Under a CSP whose script-src does not contain 'unsafe-inline', which source expressions can allow one…
- A server uses a nonce-based CSP. Put the steps for one page view in order, first to last.
- A page is served with Content-Security-Policy: require-trusted-types-for 'script' and creates no Trusted…
- Under a CSP of script-src 'self' (without 'unsafe-eval'), calling eval('1 + 1') from a same-origin script…
- Predict the output: direct eval, indirect eval and new Function reading a variable.
- A cookie set with the HttpOnly attribute is hidden from document.cookie but is still sent with requests to…
- Chromium stores a cookie set with SameSite=None even when the Secure attribute is missing, and treats it as…
- Right after login, app.example sets three cookies: a=1; SameSite=Lax, b=1; SameSite=Strict and c=1 (no…
- Which of these help protect a cookie-authenticated app against CSRF?
- Why does requiring a custom request header such as X-CSRF-Token (checked by the server) stop a cross-site…
- Put the steps of a classic CSRF attack in order, first to last.
- A single-page app keeps its access token in localStorage and sends it in an Authorization header. Compared…
- An API answers every request with Access-Control-Allow-Origin: <the request's Origin header> and…
- If a server responds with Access-Control-Allow-Origin: * and Access-Control-Allow-Credentials: true, a…
- An API's CORS configuration allowlists the origin null (with credentials) so that a local file:// tool can…
- You want only https://partner.example to be able to embed your page in an iframe, in current Chrome, Firefox…
- A frame-ancestors directive delivered in a <meta http-equiv="Content-Security-Policy"> tag stops other sites…
- Which response headers help defend a page against clickjacking?
- A page includes <script src="https://cdn.example/lib.js" integrity="sha384-..." crossorigin="anonymous">,…
- For an SRI check on a cross-origin script to pass, the request must be CORS-enabled: the tag needs a…
- A login popup sends the user's access token with window.opener.postMessage({ token }, '*'). What is the risk?
- A page listens for message events from an embedded widget at https://widget.example. Which checks make the…
- Predict the output: three ways to check a message's origin.
- Predict the output: a recursive merge that copies a parsed JSON body.
- A naive recursive merge(target, source) copies every key of JSON.parse(body) into a plain object. Which…
- Predict the output: copying a parsed payload with Object.assign versus object spread.
- Predict the output: counting words in a plain object versus a null-prototype object.
- Which of these reduce the risk of prototype pollution when handling user-controlled keys?
- Which regex shows catastrophic backtracking in V8 (time roughly doubling with each extra character) on input…
- Why do attackers who publish a typosquatted package (for example lodahs instead of lodash) usually put their…
- Which practices reduce supply-chain risk for a JavaScript project?
- A Vite app reads import.meta.env.VITE_PAYMENT_SECRET in a component. After vite build, where does the…
- Which values are acceptable to ship in a front-end JavaScript bundle?
- In a single-page app, which of these commonly cause memory to grow each time a view is opened and closed?
- A heap snapshot in Chrome DevTools shows a growing number of Detached HTMLDivElement entries each time a…
- In V8, can the large array big be garbage-collected while keep is still alive?
- Put these events in the life of one long-lived object in V8 in order, first to last.
- Predict the output: a size-bounded LRU cache built on Map.
- Predict the output: a debounced search handler driven by a fake clock.
- Predict the output: a leading-edge throttle with a 100 ms window.
- Why is this loop slow for 1,000 boxes, and what fixes it?
- A click handler runs a 400 ms computation on the main thread, which makes the page feel frozen. Which…
- Put the phases of one interaction as measured by INP in order, first to last.
- The LCP element on a landing page is a large hero image. Which changes are likely to improve LCP?
- Which of these typically cause Cumulative Layout Shift (CLS)?
- Layout shifts that occur within 500 ms after a user's click, tap or key press are excluded from CLS.
- A route component is loaded with const Settings = lazy(() => import('./Settings')). What is the main…
- An HTML document is served with Cache-Control: no-cache and an ETag. What does the browser do on the next…
- A script was cached with Cache-Control: max-age=60 and ETag: "v1". Five minutes later the page requests it…
- The value returned by performance.now() can jump backwards if the user changes the system clock.