Full-Stack Development Case Studies & Practical Application 4

Question 1

A web app stores session tokens in localStorage. A security audit flags this as a risk. What is the recommended alternative and why?

Accepted Answer

Store tokens in HttpOnly cookies so JavaScript cannot access them, mitigating XSS theft

Answer

HttpOnly cookies are inaccessible to JavaScript, so even if XSS occurs, the attacker cannot steal the session token.

Question 2

A startup runs a single PostgreSQL instance. As they scale to 1M users, read queries slow down. They cannot yet afford a full sharding solution. What is the most practical first step?

Accepted Answer

Add a read replica and route all SELECT queries to it, keeping writes on the primary

Answer

A read replica offloads SELECT load from the primary with minimal operational overhead and no application architecture change.

Question 3

A Next.js e-commerce site has poor Core Web Vitals scores. The Largest Contentful Paint (LCP) is a hero product image. What is the highest-impact fix?

Accepted Answer

Serve the hero image with a <link rel='preload'> tag and use a modern format like WebP

Answer

Preloading the LCP image combined with a compressed modern format directly reduces the time for the browser to paint the largest element.

Question 4

A GraphQL API allows clients to request deeply nested data (e.g., user → friends → friends → posts → comments). This causes CPU spikes. What protection should be added?

Accepted Answer

Enforce query depth limiting and complexity scoring to reject excessively expensive queries

Answer

Query depth limits and complexity scores prevent clients from crafting exponentially expensive queries that exhaust server resources.

Question 5

A developer pushes a hotfix directly to the main branch to resolve a production incident. The team wants to prevent this in the future. What process change achieves this?

Accepted Answer

Enable branch protection rules requiring at least one PR review before merging to main

Answer

Branch protection rules enforce peer review as a gate, ensuring even urgent fixes get a second pair of eyes before hitting production.

Full-Stack Development Practice Test

Full-Stack Development Practice Test

Full-Stack Development Case Studies & Practical Application 4