# Nuxt Security (Vue.js / Nuxt.js)

> XSS protection, CSRF tokens, Content Security Policy, rate limiting, input sanitization, security headers

- 20 interview questions
- Senior
- [Interview Questions: Vue.js / Nuxt.js](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions.md)

## 1. What is the Nuxt Security module?

**Answer**

Nuxt Security is an official module that automatically configures a Nuxt 3 application to follow OWASP security patterns using HTTP Headers and Middlewares. It includes features like CSP (Content Security Policy), rate limiting, XSS validation, CSRF protection and security headers configuration. The module applies secure defaults while allowing granular per-route customization via routeRules.

## 2. What is the default CSP directive for script-src in Nuxt Security?

**Answer**

The default script-src directive uses 'self' (same-origin scripts), https: (HTTPS scripts), 'unsafe-inline' (inline scripts), 'strict-dynamic' (dynamic script authorization), and 'nonce-{{nonce}}' (nonce for inline scripts in SSR). This combination balances security and compatibility, though 'strict-dynamic' is recommended for strict security in production.

## 3. What is a nonce in the context of Content Security Policy?

**Answer**

A nonce (number used once) is a unique random token generated server-side for each request and included in both the CSP header and inline script tags. It allows only inline scripts that have this specific nonce, blocking XSS-injected scripts that wouldn't have the correct nonce. In Nuxt Security, nonce is enabled by default in SSR with security.nonce: true and the placeholder 'nonce-{{nonce}}' in script-src.

## 17 more questions available

- Which HTTP header protects against clickjacking attacks?
- What is the difference between SSR and SSG for Content Security Policy in Nuxt Security?

Sign up for free: https://sharpskill.dev/en/login

## Other Vue.js / Nuxt.js interview topics

- [JavaScript Fundamentals](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/javascript-fundamentals.md): 20 questions, Junior
- [Modern JavaScript (ES6+)](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/es6-modern-javascript.md): 20 questions, Junior
- [Vue Basics](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/vue-basics.md): 22 questions, Junior
- [Vue Components](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/vue-components.md): 20 questions, Junior
- [Vue Router](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/vue-router.md): 18 questions, Junior
- [Pinia State Management](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/pinia-state-management.md): 20 questions, Junior
- [Vuex (Legacy)](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/vuex-legacy.md): 15 questions, Mid-Level
- [Composition API](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/composition-api.md): 24 questions, Mid-Level
- [Vue Reactivity](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/vue-reactivity.md): 20 questions, Mid-Level
- [Nuxt Fundamentals](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/nuxt-fundamentals.md): 22 questions, Mid-Level
- [Nuxt Data Fetching](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/nuxt-data-fetching.md): 20 questions, Mid-Level
- [Nuxt SSR & SSG](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/nuxt-ssr-ssg.md): 22 questions, Mid-Level
- [Nuxt Server Routes](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/nuxt-server-routes.md): 20 questions, Mid-Level
- [Nuxt Modules](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/nuxt-modules.md): 18 questions, Mid-Level
- [Vue Composables](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/vue-composables.md): 20 questions, Mid-Level
- [Vue Forms & Validation](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/vue-forms-validation.md): 20 questions, Mid-Level
- [Nuxt State Management](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/nuxt-state-management.md): 18 questions, Mid-Level
- [Vue Testing](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/vue-testing.md): 20 questions, Mid-Level
- [Nuxt Deployment & CI/CD](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/nuxt-deployment-cicd.md): 22 questions, Mid-Level
- [Vue Performance](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/vue-performance.md): 22 questions, Senior
- [Vue Advanced Patterns](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/vue-advanced-patterns.md): 24 questions, Senior
- [TypeScript with Vue](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/typescript-vue.md): 22 questions, Senior
- [Nuxt Authentication](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/nuxt-auth.md): 20 questions, Senior
- [SEO with Nuxt](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/nuxt-seo.md): 20 questions, Senior
- [Nuxt Internationalization](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/nuxt-i18n.md): 18 questions, Senior
- [Vue Architecture](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/vue-architecture.md): 22 questions, Senior
- [Vue Ecosystem](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/vue-ecosystem.md): 18 questions, Senior
- [Migration Vue 2→3 & Nuxt 2→3](https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/migration-vue2-vue3-nuxt2-nuxt3.md): 22 questions, Senior

---

Source: SharpSkill (https://sharpskill.dev), tech interview preparation for your real stack.
HTML version of this page: https://sharpskill.dev/en/technologies/vue-nuxt/interview-questions/nuxt-security