E-Commerce Development Security 5 — Questions and Answers
Question 1: Which attack targets the build pipeline of an e-commerce platform by injecting malicious code into a third-party npm package it depends on?
- Man-in-the-middle attack
- Supply chain attack (Correct answer)
- Buffer overflow
- Cross-site scripting
Correct answer: Supply chain attack
Supply chain attacks compromise upstream dependencies to deliver malicious code to all downstream consumers.
Question 2: What is subresource integrity (SRI) used for in e-commerce front-end development?
- Compressing static assets for faster delivery
- Verifying that CDN-served scripts have not been tampered with (Correct answer)
- Caching third-party scripts in the browser
- Blocking third-party cookies from CDNs
Correct answer: Verifying that CDN-served scripts have not been tampered with
SRI uses a cryptographic hash in the script tag to ensure the fetched file matches the expected content.
Question 3: A bot repeatedly attempts to redeem single-use discount codes on your checkout. What control best mitigates this?
- Increase discount code length
- Implement rate limiting and CAPTCHA on the coupon redemption endpoint (Correct answer)
- Switch from POST to GET for coupon submission
- Log all failed redemption attempts only
Correct answer: Implement rate limiting and CAPTCHA on the coupon redemption endpoint
Rate limiting restricts the number of attempts per IP or account, and CAPTCHA distinguishes bots from humans.
Question 4: Which TLS configuration flaw allows an attacker to downgrade a connection to an older vulnerable protocol version?
- Weak cipher suite selection
- Missing HSTS header
- Allowing TLS 1.0 or 1.1 on the server (Correct answer)
- Using self-signed certificates
Correct answer: Allowing TLS 1.0 or 1.1 on the server
If the server still supports TLS 1.0 or 1.1, attackers can force a protocol downgrade exploiting known vulnerabilities.
Question 5: What is the difference between authentication and authorization in an e-commerce API context?
- Authentication encrypts data; authorization signs it
- Authentication verifies who the caller is; authorization determines what they are allowed to do (Correct answer)
- Authentication uses tokens; authorization uses passwords
- They are interchangeable terms for access control
Correct answer: Authentication verifies who the caller is; authorization determines what they are allowed to do
Authentication confirms identity while authorization enforces permissions on what resources can be accessed.
Question 6: An e-commerce site accepts file uploads for product images without validating file type. What attack becomes possible?
- SQL injection via image metadata
- Remote code execution via an uploaded web shell (Correct answer)
- CSRF via image URLs
- DNS rebinding
Correct answer: Remote code execution via an uploaded web shell
Without file type validation, an attacker can upload a server-side script and execute arbitrary commands on the server.
Question 7: Which security measure prevents a compromised third-party chat widget from exfiltrating payment data entered on your checkout page?
- CORS headers on the checkout endpoint
- Content-Security-Policy with a strict connect-src directive (Correct answer)
- TLS certificate pinning
- X-Frame-Options: DENY
Correct answer: Content-Security-Policy with a strict connect-src directive
A strict CSP connect-src whitelist prevents unauthorized scripts from making outbound HTTP requests to attacker-controlled servers.
E-Commerce Development Security 5
Which attack targets the build pipeline of an e-commerce platform by injecting malicious code into a third-party npm package it depends on?