Back-End Development Back-End Security and Authentication 2 — Questions and Answers
Question 1: What is a CSRF attack and how is it typically prevented?
- A database attack prevented by encryption
- Cross-Site Request Forgery — prevented by using CSRF tokens in forms and state-changing requests (Correct answer)
- A code injection attack prevented by input sanitization
- A session hijacking attack prevented by HTTPS
Correct answer: Cross-Site Request Forgery — prevented by using CSRF tokens in forms and state-changing requests
CSRF tricks authenticated users into unknowingly submitting malicious requests; CSRF tokens ensure only forms served by the legitimate site can submit state-changing requests.
Question 2: What is the purpose of HTTPS in back-end web development?
- To speed up server response times
- To encrypt data transmitted between the client and server using TLS (Correct answer)
- To authenticate users automatically
- To prevent SQL injection attacks
Correct answer: To encrypt data transmitted between the client and server using TLS
HTTPS uses TLS (Transport Layer Security) to encrypt all data in transit, preventing eavesdropping and man-in-the-middle attacks.
Question 3: What is session fixation and how can it be mitigated?
- Storing sessions in cookies — mitigated by using local storage
- An attack where an attacker sets a known session ID before login — mitigated by regenerating session IDs after authentication (Correct answer)
- Expired sessions causing logout — mitigated by extending timeout
- Hard-coded sessions — mitigated by using environment variables
Correct answer: An attack where an attacker sets a known session ID before login — mitigated by regenerating session IDs after authentication
Session fixation lets an attacker pre-set a session ID; regenerating a new session ID after successful login prevents the attacker from using the known ID.
Question 4: What hashing algorithm is recommended for storing passwords and why?
- MD5 — it is fast and widely supported
- SHA-256 — it is a government standard
- bcrypt or Argon2 — they are slow by design and include salting (Correct answer)
- Base64 — it is reversible for password recovery
Correct answer: bcrypt or Argon2 — they are slow by design and include salting
bcrypt and Argon2 are specifically designed for password hashing with configurable work factors and automatic salting, making brute-force attacks impractical.
Question 5: What is the principle of least privilege in back-end security?
- Giving all users admin rights to improve productivity
- Granting users and services only the minimum permissions needed to perform their tasks (Correct answer)
- Encrypting all user data regardless of sensitivity
- Using a single shared database account for all services
Correct answer: Granting users and services only the minimum permissions needed to perform their tasks
The principle of least privilege limits damage from breaches or bugs by ensuring each user and service has only the access rights required for their specific function.
Question 6: What is a refresh token and how does it work alongside an access token?
- A token that refreshes the UI automatically when data changes
- A long-lived token used to obtain new short-lived access tokens without re-authentication (Correct answer)
- A token that refreshes database connections
- A token that replaces the session cookie
Correct answer: A long-lived token used to obtain new short-lived access tokens without re-authentication
Refresh tokens are long-lived credentials stored securely that allow clients to obtain new short-lived access tokens when they expire, without requiring the user to log in again.
Back-End Development Back-End Security and Authentication 2
What is a CSRF attack and how is it typically prevented?