Web Development Security 3 — Questions and Answers
Question 1: What is the key difference between authentication and authorization in web security?
- Authentication verifies who you are; authorization determines what you can do (Correct answer)
- Authentication grants access rights; authorization verifies identity
- Authentication uses tokens; authorization uses passwords
- Authentication is server-side; authorization is client-side
Correct answer: Authentication verifies who you are; authorization determines what you can do
Authentication (authn) confirms identity while authorization (authz) enforces permissions — both are required for secure access control.
Question 2: Which attack allows an adversary to read memory from adjacent process space by exploiting a buffer length field without validating it?
- Heartbleed (buffer over-read) (Correct answer)
- Stack smashing (buffer overflow)
- Format string attack
- Use-after-free exploit
Correct answer: Heartbleed (buffer over-read)
Heartbleed exploited OpenSSL's failure to validate the 'length' field in TLS heartbeat requests, leaking up to 64KB of server memory per request.
Question 3: When using JWTs for session management, what is the safest place to store the token in a browser?
- An httpOnly, Secure, SameSite=Strict cookie (Correct answer)
- localStorage
- sessionStorage
- A JavaScript variable in memory
Correct answer: An httpOnly, Secure, SameSite=Strict cookie
Storing JWTs in httpOnly cookies protects them from XSS attacks since JavaScript cannot access httpOnly cookies.
Question 4: What is clickjacking, and which HTTP header primarily defends against it?
- Embedding a target site in an invisible iframe to trick users into clicking; X-Frame-Options or frame-ancestors CSP (Correct answer)
- Hijacking session cookies via network sniffing; Strict-Transport-Security
- Injecting malicious links into emails; Content-Security-Policy script-src
- Overloading a server with fake clicks; Rate-Limit headers
Correct answer: Embedding a target site in an invisible iframe to trick users into clicking; X-Frame-Options or frame-ancestors CSP
Clickjacking tricks users into clicking hidden UI elements by overlaying an iframe; X-Frame-Options: DENY or CSP frame-ancestors blocks iframe embedding.
Question 5: In a SQL injection attack, what does a UNION-based injection attempt to achieve?
- Append an additional SELECT query to extract data from other database tables (Correct answer)
- Delete all rows in the target table
- Bypass login by making the WHERE clause always true
- Execute operating system commands via database stored procedures
Correct answer: Append an additional SELECT query to extract data from other database tables
UNION-based SQLi appends a second SELECT statement to the original query, returning data from tables the attacker chooses.
Question 6: Which principle recommends giving users and processes only the minimum permissions necessary to perform their function?
- Principle of Least Privilege (Correct answer)
- Defense in Depth
- Separation of Duties
- Fail-Safe Defaults
Correct answer: Principle of Least Privilege
Least Privilege limits the blast radius of compromised accounts or components by ensuring they only hold permissions they actually need.
Question 7: What is the purpose of a nonce in a Content Security Policy?
- To allow specific inline scripts or styles that include the matching nonce attribute (Correct answer)
- To generate a unique session identifier for each user
- To encrypt the CSP header value during transit
- To set the maximum age of cached CSP policies
Correct answer: To allow specific inline scripts or styles that include the matching nonce attribute
A CSP nonce is a cryptographically random value added to both the CSP header and allowed script tags, permitting only those scripts while blocking others.
Web Development Security 3
What is the key difference between authentication and authorization in web security?