E-Commerce Development Security 3

Question 1

Which OAuth 2.0 grant type is recommended for server-side e-commerce web applications exchanging a code for tokens?

Accepted Answer

Authorization code grant

Answer

The authorization code grant keeps tokens server-side and is the most secure flow for web applications.

Question 2

A developer stores the Stripe secret key directly in client-side JavaScript. What is the primary risk?

Accepted Answer

Anyone can view source code and extract the key to make unauthorized charges

Answer

Client-side code is publicly visible, exposing secret keys to anyone who views page source.

Question 3

What is the purpose of a Web Application Firewall (WAF) in front of an e-commerce site?

Accepted Answer

Filters and blocks malicious HTTP traffic before it reaches the application

Answer

A WAF inspects incoming HTTP requests and blocks known attack patterns like SQLi and XSS before they reach the app.

Question 4

Which Content-Security-Policy directive prevents your e-commerce pages from being embedded in iframes on other domains?

Accepted Answer

frame-ancestors

Answer

The frame-ancestors directive specifies which origins are allowed to embed the page, preventing clickjacking.

Question 5

An e-commerce API returns detailed database error messages to the client when a query fails. What risk does this create?

Accepted Answer

Information disclosure that aids attackers in crafting SQL injection attacks

Answer

Verbose error messages reveal table names, query structure, and stack traces that help attackers exploit the system.

E-Commerce Development Practice Test