Web Programming Security Web Programming 4 — Questions and Answers
Question 1: Which HTTP method should be used for state-changing operations to benefit from CSRF token protections?
- GET
- HEAD
- OPTIONS
- POST (Correct answer)
Correct answer: POST
POST (and other non-idempotent methods like PUT/DELETE) are used for state changes; CSRF tokens in request bodies protect these endpoints.
Question 2: What is Server-Side Request Forgery (SSRF)?
- The server forges user session tokens
- The server is tricked into making requests to internal resources on behalf of an attacker (Correct answer)
- An attacker forges HTTP headers to bypass authentication
- A forged certificate is used to intercept HTTPS traffic
Correct answer: The server is tricked into making requests to internal resources on behalf of an attacker
SSRF exploits a server's ability to make HTTP requests, allowing attackers to reach internal services, cloud metadata endpoints, or other restricted resources.
Question 3: Which algorithm is recommended for hashing passwords in a modern web application?
- SHA-256
- MD5
- bcrypt (Correct answer)
- AES-256
Correct answer: bcrypt
bcrypt (and similar algorithms like Argon2 or scrypt) is designed to be computationally slow and includes built-in salting, making brute-force attacks expensive.
Question 4: A JWT token's signature is verified on the server. What attack is prevented when the server rejects `alg: none` in the header?
- Token theft via XSS
- Algorithm confusion / signature bypass (Correct answer)
- Replay attacks
- Privilege escalation via payload tampering
Correct answer: Algorithm confusion / signature bypass
Rejecting `alg: none` prevents attackers from forging tokens by stripping the signature and claiming no verification is needed.
Question 5: Which security header tells the browser to refuse to render the page inside a frame, preventing clickjacking?
- X-Content-Type-Options
- X-Frame-Options (Correct answer)
- Strict-Transport-Security
- X-XSS-Protection
Correct answer: X-Frame-Options
X-Frame-Options: DENY or SAMEORIGIN prevents the browser from embedding the page in an iframe, blocking clickjacking attacks.
Question 6: What is insecure direct object reference (IDOR)?
- Calling internal functions directly from JavaScript
- Accessing resources by manipulating an identifier without authorization checks (Correct answer)
- Using HTTP instead of HTTPS to reference assets
- Directly embedding database credentials in HTML
Correct answer: Accessing resources by manipulating an identifier without authorization checks
IDOR occurs when an application exposes internal object IDs (like user IDs or file names) in URLs or params without verifying the requester has permission.
Question 7: Which practice best mitigates credential stuffing attacks?
- Enforcing a minimum password length of 8 characters
- Implementing multi-factor authentication and rate limiting logins (Correct answer)
- Requiring users to change passwords every 30 days
- Storing passwords with SHA-1 hashing
Correct answer: Implementing multi-factor authentication and rate limiting logins
MFA renders stolen credential pairs useless, and rate limiting slows automated login attempts that characterize credential stuffing.
Web Programming Security Web Programming 4
Which HTTP method should be used for state-changing operations to benefit from CSRF token protections?