Web Programming Security Web Programming 4

Question 1

Which HTTP method should be used for state-changing operations to benefit from CSRF token protections?

Accepted Answer

POST

Answer

POST (and other non-idempotent methods like PUT/DELETE) are used for state changes; CSRF tokens in request bodies protect these endpoints.

Question 2

What is Server-Side Request Forgery (SSRF)?

Accepted Answer

The server is tricked into making requests to internal resources on behalf of an attacker

Answer

SSRF exploits a server's ability to make HTTP requests, allowing attackers to reach internal services, cloud metadata endpoints, or other restricted resources.

Question 3

Which algorithm is recommended for hashing passwords in a modern web application?

Accepted Answer

bcrypt

Answer

bcrypt (and similar algorithms like Argon2 or scrypt) is designed to be computationally slow and includes built-in salting, making brute-force attacks expensive.

Question 4

A JWT token's signature is verified on the server. What attack is prevented when the server rejects `alg: none` in the header?

Accepted Answer

Algorithm confusion / signature bypass

Answer

Rejecting `alg: none` prevents attackers from forging tokens by stripping the signature and claiming no verification is needed.

Question 5

Which security header tells the browser to refuse to render the page inside a frame, preventing clickjacking?

Accepted Answer

X-Frame-Options

Answer

X-Frame-Options: DENY or SAMEORIGIN prevents the browser from embedding the page in an iframe, blocking clickjacking attacks.

Web Programming Practice Test

Web Programming Practice Test

Web Programming Security Web Programming 4