CASE Secure Session Management

Question 1

What is the best defense against session fixation?

Accepted Answer

Issuing a new session ID immediately after successful authentication

Answer

In session fixation, the attacker plants a known session ID before the victim logs in. Issuing a new ID at login makes the planted ID useless.

Question 2

Which cookie attribute stops client-side scripts from reading the session cookie?

Accepted Answer

HttpOnly

Answer

HttpOnly blocks JavaScript access through document.cookie, which limits session theft through XSS. Secure only restricts the cookie to HTTPS.

Question 3

What does the SameSite=Strict cookie attribute mainly protect against?

Accepted Answer

Cross-site request forgery (CSRF)

Answer

SameSite=Strict stops the browser from sending the cookie on cross-site requests. That blocks most CSRF attacks, which depend on the victim's cookies being attached automatically.

Question 4

Which property is most important for a session identifier?

Accepted Answer

It is long, random and generated by a cryptographically secure generator

Answer

Session IDs must be unpredictable, with enough entropy (OWASP recommends at least 64 bits) from a CSPRNG, so attackers cannot guess or brute-force valid sessions.

Question 5

What should happen on the server when a user clicks 'Logout'?

Accepted Answer

The server-side session is invalidated and the cookie is cleared

Answer

Deleting only the client cookie leaves the server-side session valid, so a stolen ID could be replayed. Proper logout invalidates the session on the server.

(CASE) Certified Application Security Engineer Practice Test

(CASE) Certified Application Security Engineer Practice Test

CASE Secure Session Management