Web Programming Security Web Programming 3

Question 1

What does the `SameSite=Strict` cookie attribute do?

Accepted Answer

Prevents the cookie from being sent on cross-site requests

Answer

SameSite=Strict prevents the browser from sending the cookie with any cross-site request, providing strong CSRF protection.

Question 2

Which vulnerability is exploited when an attacker manipulates a URL parameter like `?file=../../../../etc/passwd`?

Accepted Answer

Path Traversal

Answer

Path traversal (directory traversal) uses ../ sequences to escape the intended directory and access arbitrary files on the server.

Question 3

A web app forwards users to a URL from the query string without validation: `redirect?url=https://evil.com`. What is this?

Accepted Answer

Open Redirect

Answer

An open redirect allows attackers to redirect users to arbitrary external URLs, often used for phishing.

Question 4

Which of the following is the correct way to prevent SQL injection in most languages?

Accepted Answer

Use parameterized queries or prepared statements

Answer

Parameterized queries separate SQL code from data, so user input is never interpreted as SQL regardless of its content.

Question 5

What is the role of a nonce in a Content Security Policy?

Accepted Answer

It allows specific inline scripts while blocking others

Answer

A CSP nonce is a random per-request token added to allowed script tags, letting specific inline scripts run while blocking all others.

Web Programming Practice Test