Interview_SOP/ CORS/ REST/ SOAP/ cache/ proxy/load balancing

📌 SOP, CORS, XXS, CSRF, SQL injection, XML injection

✅ What is origin?

- protocol ➕ host ➕ port

✅ What is SOP?

- Same Origin Policy
- resource can be shared only between same server/same domain/same origin

✅ What are the benefits of SOP?

- prevent from malicious attacks such as XXS, CSRF, SQL injection

✅ What is XXS? And how can we prevent?

- Cross Site Scripting
- malicious scripts into web pages
- steal data, impersonate the user, or manipulate the webpage's content
- steal cookies, session tokens, credentials

💊 input validation
💊 output encoding
💊 CSP: content security policy
💊 중요 cookie HTTP ONLY

✅ Input validation 어떻게 구현하는지?

- 폼 데이터
- Script tag 걸러주기
- 인풋에 특수문자 삭제하기, 일반 문자로 바꾸기

✅ What is CSRF? And how can we prevent?

- Cross Site Rquest Forgery
- web-based attack - trick a user into performing an unwanted action on a website where they are already authenticated
- transfer funds, change passwords, or perform other actions without the user’s consent.

💊 CSRF token
💊 cookie `SameSite` only header
💊 CAPTCHA

✅ What is SQL injection? And how can we prevent?

- insert malicious SQL code
- Use URL parameter, form fields, cookies, POST data, HTTP headers
- like delete user

💊 input validation
💊 sanitize user data
💊 WAF

✅ What XML injection? And how can we prevent?

- insert malicious code to trusted site
- XML bomb
- XXE

💊 input validation
💊 sanitiza user data
💊 WAF

✅ What is CORS?

- Cross Origin Resource Sharing
- for frontend, backend to communicate

✅ How can we prevent CORS error?

1. browser extension
2. proxy server
3. backend settings: add `Access-Control-Allow-Origin` to `HTTP response header`

✅ What is proxy?

- Proxy between client and server as intermediary
- Proxy server will allow resource shared between different origin
- solution to CORS error

📌 REST, SOAP

✅ What is SOAP? When is it used?

- Simple Object Access Protocol
- Protocol to exchange structured information
- exchange XML messages

👍🏻 transaction, more secure
👍🏻 ACID(Automicity, Consistency, Isolation, Durability)
👎🏻 complex message
👎🏻 so strict! more rules.

✅ What is REST?

- Representational State Transfer
- 자원을 이름으로 구분(URI), 자원의 상태를 주고받기
- architectural structure to create APIs
- state: HTTP Status code
- HTTP URI, HTTP Method

✅ What is a Restful API? What are the conditions?

- API that follows the REST architecture
- HTTP CRUD 특징을 많이 가진다.

- client-server
- statelessness
- cache
- layered system
- uniform interface
- URI
- self-descriptive message
- HATEOAS
- code-on-demand(optional)

✅ How is the maturity level of REST?

- URI
- HTTP Methods
- HATEOAS
- L0: single URI, single verb
- L1: multiple URIs, single verb
- L2: multiple URIs, multiple verbs
- L3: HATEOAS

URI 🆚 URN 🆚 URL

✅ Difference between URI, URN, URL?

- URI ⊃ URL, URN

✅ Why do we need URN, when we have URL?

- location of the resource can change
- URL can change
- URN will remain fixed

📌 Web cache

✅ What is web cache? What are the benefits of using cache?

- copied data to remember frequent request
👍🏻 reduce network bottleneck
👍🏻 bandwidth ⬆️

✅ What is cache hit, miss?

- cache hit: find request in cache
- cache miss: do not find request in cache, need to go to original server

✅ What is cache revalidation?

- check if cache data is identical to original server data

📌 Proxy server

✅ What is proxy server?

- intermediary between server-client
- connect application using same protocol

✅ Forward proxy server?

- 클라이언트 앞에
- exit point from client to server
- outbound traffic
- protect client information

✅ Reserse proxy server?

- 서버 앞에
- entry point to server
- inbound traffic - protect server

✅ What are some functions of a proxy server?

- load balancing
- security
- caching
- SSL termination
- filtering
- access control
- surrogate: reverse proxy
- contents router
- transcoder
- anoymizer

Proxy 🆚 Gateway

- proxy: connect application using same protocol
- gateway: connect application using different protocol

Proxy 🆚 VPN

- proxy: handle network traffic
- VPN: encrypt transmitted data

✅ Is WAF a reverse proxy?

- YES. intercept traffic before reaching server

📌 Load Balancing

✅ What does a level 4 load balancer do?

- route traffic based on IPs and TCP, UDP ports
- packet level load balancing
- unable to make routing decisions based on contet, media type, localization rules
- ASIC

✅ What does a level 7 load balancer do?

- routing decisions based on IP, TCP, UDP, ports, HTTP
- makes content based routing decisions
- acts as a proxy: contain two TCP connections
(one with client, another with server)

📌 Request timeout

✅ Why do we use timeout?

- networks are unreliable
- set a max wait time on request
- client: how long client will wait for response
- server: how long to maintain connection

✅ What is a connection timeout?

- how long the client will wait for a connection to establish
- TCP 연결 확립이 수행되는데 걸리는 최대 시간

✅ What is a write timeout?

- how long connection will wait while the client tries to send a data, like POST

✅ What is a read timeout?

- time it takes to recieve response back from the server
- 요청과 응답이 수행되는데 걸리는 최대 시간