E-Commerce Development Security 3 — Questions and Answers
Question 1: Which OAuth 2.0 grant type is recommended for server-side e-commerce web applications exchanging a code for tokens?
- Implicit grant
- Authorization code grant (Correct answer)
- Client credentials grant
- Resource owner password grant
Correct answer: Authorization code grant
The authorization code grant keeps tokens server-side and is the most secure flow for web applications.
Question 2: A developer stores the Stripe secret key directly in client-side JavaScript. What is the primary risk?
- The key could be rate-limited
- Anyone can view source code and extract the key to make unauthorized charges (Correct answer)
- Stripe will reject requests from browsers
- The key will expire faster
Correct answer: Anyone can view source code and extract the key to make unauthorized charges
Client-side code is publicly visible, exposing secret keys to anyone who views page source.
Question 3: What is the purpose of a Web Application Firewall (WAF) in front of an e-commerce site?
- Encrypts database connections
- Filters and blocks malicious HTTP traffic before it reaches the application (Correct answer)
- Manages SSL certificate renewal
- Balances load across multiple servers
Correct answer: Filters and blocks malicious HTTP traffic before it reaches the application
A WAF inspects incoming HTTP requests and blocks known attack patterns like SQLi and XSS before they reach the app.
Question 4: Which Content-Security-Policy directive prevents your e-commerce pages from being embedded in iframes on other domains?
- script-src
- frame-ancestors (Correct answer)
- default-src
- connect-src
Correct answer: frame-ancestors
The frame-ancestors directive specifies which origins are allowed to embed the page, preventing clickjacking.
Question 5: An e-commerce API returns detailed database error messages to the client when a query fails. What risk does this create?
- Increased server load
- Information disclosure that aids attackers in crafting SQL injection attacks (Correct answer)
- Slower page load times
- CORS policy violations
Correct answer: Information disclosure that aids attackers in crafting SQL injection attacks
Verbose error messages reveal table names, query structure, and stack traces that help attackers exploit the system.
Question 6: What is credential stuffing in the context of e-commerce account security?
- Brute-forcing passwords using a dictionary
- Using leaked username/password pairs from other breaches to log into accounts (Correct answer)
- Embedding credentials in URL parameters
- Storing credentials in browser autofill
Correct answer: Using leaked username/password pairs from other breaches to log into accounts
Credential stuffing automates login attempts using username/password pairs leaked from unrelated breaches.
Question 7: Which header prevents browsers from MIME-sniffing a response away from the declared Content-Type?
- X-Frame-Options
- Referrer-Policy
- X-Content-Type-Options: nosniff (Correct answer)
- Permissions-Policy
Correct answer: X-Content-Type-Options: nosniff
X-Content-Type-Options: nosniff forces browsers to respect the declared content type, preventing MIME confusion attacks.
E-Commerce Development Security 3
Which OAuth 2.0 grant type is recommended for server-side e-commerce web applications exchanging a code for tokens?