Question 1

What does the SameSite cookie attribute do?

Accepted Answer

SameSite controls whether a cookie is sent on requests originating from a different site. It exists primarily to mitigate cross-site request forgery, where a malicious page causes your browser to make an authenticated request to a site you are logged into, relying on the cookie being attached automatically.

There are three values.

Strict never sends the cookie on any cross-site request. It is the safest and has a noticeable side effect: following a link from another site to yours arrives without the cookie, so the user appears logged out until they navigate again. That is often unacceptable for a session cookie and fine for a sensitive one.

Lax sends the cookie on top-level navigations using safe methods, so following a link works, but withholds it on form posts, embedded images and background requests from other sites. This is the modern default in browsers when the attribute is absent, and it is a reasonable balance for session cookies.

None sends the cookie on all cross-site requests, restoring the old behaviour. Browsers require the secure flag alongside it, so it only works over HTTPS. This is needed for genuine cross-site use cases such as embedded widgets and some authentication flows.

The change to defaulting to Lax broke a number of integrations that relied on unspecified behaviour, which is why the attribute suddenly became widely discussed. If something worked previously and now fails only in a cross-site context, this is a strong candidate.

SameSite is a defence in depth measure rather than a complete solution. It should be combined with anti-forgery tokens for state-changing operations, since browser behaviour varies and older clients may not enforce it.

Question 2

What is cross-site scripting (XSS)?

Accepted Answer

An attack where attacker-controlled content is executed as JavaScript in another user's browser, in the context of your site — which means it runs with that user's session, cookies and permissions.

Question 3

What is CSRF, and how is it different from XSS?

Accepted Answer

Cross-site request forgery makes a user's browser send a request they did not intend, to a site where they are already authenticated — exploiting the fact that browsers attach cookies automatically

Question 4

What is the difference between authentication and authorization?

Accepted Answer

Authentication establishes who someone is. Authorization determines what that identity is allowed to do. They are sequential: you cannot meaningfully decide permissions before you know the identity,

Question 5

What is a JWT, and when should you not use one?

Accepted Answer

A JSON Web Token is a signed, self-contained token carrying claims — typically who the user is and when the token expires — which a server can verify without a database lookup. That property is its

Question 6

What is event bubbling and how do I stop it?

Accepted Answer

When an event fires on an element, it does not stay there. It travels down from the document root to the target, then back up through every ancestor. Those two phases are called capturing and

Question 7

What are the different methods for implementing authentication in a Django REST API?

Accepted Answer

Django REST API authentication methods include Basic, Token, Session, OAuth2, and JWT authentication, each suited for different use cases and security requirements.

Related Questions