Web Programming Security Web Programming 2 — Questions and Answers
Question 1: Which HTTP header prevents a browser from MIME-sniffing a response away from the declared content type?
- X-Frame-Options
- X-Content-Type-Options (Correct answer)
- Referrer-Policy
- Permissions-Policy
Correct answer: X-Content-Type-Options
X-Content-Type-Options: nosniff tells browsers to strictly follow the declared Content-Type and not guess the MIME type.
Question 2: An attacker injects `'; DROP TABLE users; --` into a login form. What attack is this?
- XSS
- CSRF
- SQL Injection (Correct answer)
- Command Injection
Correct answer: SQL Injection
SQL Injection occurs when user-supplied data is embedded in a SQL query without parameterization, allowing arbitrary SQL to execute.
Question 3: Which Content Security Policy directive controls which sources can load JavaScript?
- script-src (Correct answer)
- connect-src
- default-src
- form-action
Correct answer: script-src
The script-src directive in CSP specifies valid sources for JavaScript, blocking inline scripts and unauthorized external scripts.
Question 4: What is the primary purpose of HSTS (HTTP Strict Transport Security)?
- Encrypt cookies on the server
- Force browsers to use HTTPS instead of HTTP (Correct answer)
- Block mixed content images
- Prevent clickjacking attacks
Correct answer: Force browsers to use HTTPS instead of HTTP
HSTS tells browsers to always connect via HTTPS for a specified duration, preventing protocol downgrade attacks.
Question 5: Which of the following best describes a stored XSS attack?
- Malicious script is reflected in the server response immediately
- Script is injected via the URL fragment only
- Malicious script is saved to the database and served to other users (Correct answer)
- Script runs only in the attacker's browser
Correct answer: Malicious script is saved to the database and served to other users
Stored (persistent) XSS saves malicious scripts server-side so they execute in any victim's browser that loads the affected page.
Question 6: A developer stores passwords using MD5 without a salt. What is the primary risk?
- Passwords are stored in plain text
- Rainbow table attacks can crack hashes quickly (Correct answer)
- The algorithm is too slow for production use
- MD5 requires a secret key to function
Correct answer: Rainbow table attacks can crack hashes quickly
Unsalted MD5 hashes are vulnerable to precomputed rainbow table attacks because identical passwords produce identical hashes.
Question 7: Which authentication flaw does OAuth 2.0's `state` parameter defend against?
- Token replay attacks
- CSRF during the authorization flow (Correct answer)
- Open redirect vulnerabilities
- Brute force on authorization codes
Correct answer: CSRF during the authorization flow
The state parameter is a CSRF token that ties the authorization request to the user's session, preventing cross-site request forgery during OAuth flows.
Web Programming Security Web Programming 2
Which HTTP header prevents a browser from MIME-sniffing a response away from the declared content type?