Web Development Security 2 — Questions and Answers
Question 1: Which HTTP header prevents a browser from MIME-sniffing a response away from the declared content type?
- X-Content-Type-Options: nosniff (Correct answer)
- X-Frame-Options: DENY
- Referrer-Policy: no-referrer
- X-XSS-Protection: 1
Correct answer: X-Content-Type-Options: nosniff
X-Content-Type-Options: nosniff tells browsers to strictly follow the declared Content-Type and not guess the type from content.
Question 2: What is a Server-Side Request Forgery (SSRF) attack?
- An attacker tricks the server into making HTTP requests to internal or external resources on their behalf (Correct answer)
- An attacker forges session cookies to impersonate another user
- An attacker injects malicious scripts into server-rendered pages
- An attacker replays captured authentication tokens
Correct answer: An attacker tricks the server into making HTTP requests to internal or external resources on their behalf
SSRF exploits a server to make requests to internal services or external URLs that the attacker cannot directly access.
Question 3: In OAuth 2.0, what is the purpose of the 'state' parameter?
- To prevent CSRF attacks during the authorization flow (Correct answer)
- To encode the user's access token securely
- To specify the requested permission scopes
- To identify the OAuth client application
Correct answer: To prevent CSRF attacks during the authorization flow
The 'state' parameter is a random value the client sends and verifies on return to prevent cross-site request forgery during OAuth flows.
Question 4: Which of the following is the PRIMARY risk of using MD5 to hash passwords?
- MD5 is too fast, making brute-force and rainbow table attacks practical (Correct answer)
- MD5 produces hashes that are too short to be unique
- MD5 is not supported by modern databases
- MD5 hashes cannot be salted
Correct answer: MD5 is too fast, making brute-force and rainbow table attacks practical
MD5's speed allows attackers to compute billions of hashes per second, making password cracking via brute-force or precomputed tables feasible.
Question 5: What does the 'httpOnly' flag on a cookie do?
- Prevents client-side JavaScript from accessing the cookie (Correct answer)
- Forces the cookie to be sent only over HTTPS connections
- Sets the cookie's maximum age to one HTTP session
- Restricts the cookie to same-site requests only
Correct answer: Prevents client-side JavaScript from accessing the cookie
The httpOnly flag blocks JavaScript's document.cookie API from reading the cookie, mitigating XSS-based session theft.
Question 6: A web application returns detailed database error messages to the user. Which vulnerability class does this represent?
- Information Disclosure (Correct answer)
- SQL Injection
- Broken Access Control
- Security Misconfiguration
Correct answer: Information Disclosure
Exposing internal error details (stack traces, SQL errors) is classified as Information Disclosure and aids attackers in crafting targeted exploits.
Question 7: Which Content Security Policy directive controls where scripts can be loaded from?
- script-src (Correct answer)
- connect-src
- form-action
- default-src
Correct answer: script-src
The script-src CSP directive specifies valid sources for JavaScript, blocking inline scripts and external scripts not on the allowlist.
Web Development Security 2
Which HTTP header prevents a browser from MIME-sniffing a response away from the declared content type?