Web Programming Security Web Programming 5 — Questions and Answers
Question 1: What is the purpose of subresource integrity (SRI) when loading third-party scripts?
- It blocks all third-party scripts by default
- It verifies that a fetched resource matches an expected cryptographic hash (Correct answer)
- It routes third-party scripts through a proxy for scanning
- It restricts scripts to same-origin only
Correct answer: It verifies that a fetched resource matches an expected cryptographic hash
SRI lets browsers verify that a CDN-hosted resource hasn't been tampered with by checking its content against a hash in the integrity attribute.
Question 2: A session cookie lacks the `HttpOnly` flag. What attack does this enable?
- CSRF attacks using form submissions
- JavaScript reading the cookie via XSS (Correct answer)
- Brute-force guessing of the session ID
- SSL stripping of the cookie in transit
Correct answer: JavaScript reading the cookie via XSS
Without HttpOnly, JavaScript (including injected XSS payloads) can access the cookie via document.cookie, enabling session hijacking.
Question 3: Which OWASP category covers misconfigured cloud storage buckets left publicly readable?
- A01 Broken Access Control
- A02 Cryptographic Failures
- A05 Security Misconfiguration (Correct answer)
- A09 Security Logging Failures
Correct answer: A05 Security Misconfiguration
Publicly accessible cloud buckets are a classic security misconfiguration — default settings left insecure rather than hardened.
Question 4: What does 'defense in depth' mean in web security?
- Using the deepest encryption algorithm available
- Relying on a single, very strong firewall
- Layering multiple independent security controls so no single failure compromises the system (Correct answer)
- Auditing code only at the final release stage
Correct answer: Layering multiple independent security controls so no single failure compromises the system
Defense in depth layers controls (WAF, input validation, parameterized queries, least privilege) so that bypassing one layer doesn't give full access.
Question 5: An attacker intercepts an HTTPS session by presenting a forged certificate. What attack is this?
- Replay attack
- Man-in-the-middle (MITM) attack (Correct answer)
- Session fixation
- DNS cache poisoning
Correct answer: Man-in-the-middle (MITM) attack
A MITM attack positions the attacker between client and server, often by using a forged TLS certificate to decrypt and re-encrypt traffic.
Question 6: Which of the following is an example of security through obscurity, which is generally discouraged?
- Using bcrypt for password hashing
- Hiding admin endpoints at non-standard URLs as the only protection (Correct answer)
- Enforcing HTTPS with HSTS
- Validating all user input server-side
Correct answer: Hiding admin endpoints at non-standard URLs as the only protection
Relying solely on keeping endpoint URLs secret is security through obscurity — attackers who discover the URL gain immediate access with no other control in place.
Question 7: Which header value allows a site to report CSP violations to a specified URL without enforcing the policy?
- Content-Security-Policy: report-only
- Content-Security-Policy-Report-Only (Correct answer)
- X-CSP-Report: enable
- Content-Security-Policy: monitor-mode
Correct answer: Content-Security-Policy-Report-Only
The Content-Security-Policy-Report-Only header sends violation reports to the report-uri endpoint but does not block any resources, allowing safe policy testing.
Web Programming Security Web Programming 5
What is the purpose of subresource integrity (SRI) when loading third-party scripts?