MediumExperience level: 3-5 years · 8-15 years1 min read

JSON Security Best Practices — Interview Questions

Reviewed by Gurusankar M.

Asked inAmazonMicrosoftGoogleDeloitte
#json#security#validation#injection#mass assignment
Report issue

Short Answer

Treat all inbound JSON as untrusted: never eval() it (use JSON.parse), validate against a schema, cap body size and nesting depth (to stop DoS), allow-list fields to prevent mass assignment, and never echo it into SQL/HTML/OS commands without escaping. On output, don't leak sensitive fields (password hashes, tokens, internal ids).

On this page

Concept Made Simple

Coffee Chat Question

“What are JSON security best practices?”

Remember It Faster

Mind Map Answer

Parse safely
JSON.parse, never eval()
Validate + limit
schema, max size & depth
Allow-list
block mass assignment (isAdmin)
Output
don't leak secrets; escape when reusing

Learn by Doing

Hands-on Keyboard

javascript
// Express: cap body size to blunt DoS via giant payloads
app.use(express.json({ limit: "100kb" }));

// Allow-list fields — never spread req.body onto the entity
const { name, email } = req.body;   // ignore id, role, isAdmin
await users.create({ name, email });

Think Beyond the Expected

What If?

How can a maliciously crafted JSON payload cause a denial of service?

Several ways: an enormous body exhausts memory/bandwidth; extremely deep nesting can blow the parser's stack; and huge arrays/strings spike CPU during parse. Defenses: enforce a max request size, limit nesting depth, set parse timeouts, and reject oversized/over-deep payloads with a 413/400 before processing.

Real World

Mass assignment (binding req.body straight onto a model so a user sets isAdmin=true) and 'parse an HTML page as JSON via eval' are real, repeatedly-exploited bugs. Size/depth limits and schema validation are standard hardening at the API edge.

Interviewer's Expectation

Keywords they're listening for:

  • never eval
  • validate + size/depth limits
  • prevent mass assignment
  • escape when reusing (SQLi/XSS)
  • don't leak sensitive fields

Common Mistakes

  • Using eval() to parse JSON
  • Spreading req.body directly onto entities
  • No size/depth limits on request bodies

Best Practices

  • Validate, size-limit, and depth-limit input
  • Allow-list fields; own privileged fields server-side
  • Escape on reuse; never leak secrets in responses

Follow-up Questions

  1. What is a mass-assignment vulnerability?
  2. How does deep nesting enable a DoS?
  3. Why must you escape JSON before putting it in HTML/SQL?

Continue Learning with AI

Take this question deeper with your favourite AI assistant. Pick a depth, copy the prompt, or open it directly — AI is your learning companion, not a shortcut.

Plain-language foundations

I'm preparing for a software engineering interview and want to understand this from scratch, as a beginner.

Topic: Security (JSON)
Interview question: "What are JSON security best practices?"

Please:
1. Explain the core idea in simple, plain language, using an everyday analogy.
2. Define any technical terms you use.
3. Walk through one small, concrete example.
4. Finish with a single sentence I can easily remember.

Keep the tone friendly and assume I'm new to this topic.
Open inChatGPTGeminiClaude

Was this answer helpful?

Affiliate links

Tools for Your Developer Workspace

Equipment for a comfortable, productive setup.

As an Amazon Associate I earn from qualifying purchases.