Web Programming Website And Web Server Programming 4 — Questions and Answers
Question 1: Which header in an HTTP response tells the browser how long to cache the response before revalidating?
- Cache-Control (Correct answer)
- Expires
- ETag
- Last-Modified
Correct answer: Cache-Control
Cache-Control with directives like max-age=3600 is the modern standard for controlling caching behavior in both browsers and proxies.
Question 2: In Express.js (Node.js), what does middleware do?
- Intercepts requests and responses to execute code before the route handler (Correct answer)
- Connects to the database during server startup
- Minifies JavaScript files at build time
- Manages session storage in Redis
Correct answer: Intercepts requests and responses to execute code before the route handler
Express middleware functions have access to req, res, and next, allowing them to modify requests/responses or terminate the cycle.
Question 3: What is the difference between authentication and authorization in web server security?
- Authentication verifies identity; authorization determines what actions that identity can perform (Correct answer)
- Authentication encrypts data; authorization compresses it
- Authentication uses HTTPS; authorization uses HTTP
- They are synonymous terms
Correct answer: Authentication verifies identity; authorization determines what actions that identity can perform
Authentication answers 'who are you?' while authorization answers 'what are you allowed to do?' — they are distinct security concerns.
Question 4: Which server-side technique prevents a website from being embedded in an iframe on other domains to stop clickjacking attacks?
- Setting the X-Frame-Options header to DENY or SAMEORIGIN (Correct answer)
- Enabling GZIP compression
- Using HTTPS instead of HTTP
- Enabling server-side rendering
Correct answer: Setting the X-Frame-Options header to DENY or SAMEORIGIN
X-Frame-Options (or the Content-Security-Policy frame-ancestors directive) instructs browsers not to render the page inside a frame from unauthorized origins.
Question 5: In a PHP application, what is the risk of using `eval()` with user-supplied input?
- It executes arbitrary PHP code, allowing remote code execution attacks (Correct answer)
- It causes infinite loops in the session handler
- It disables output buffering permanently
- It breaks UTF-8 encoding
Correct answer: It executes arbitrary PHP code, allowing remote code execution attacks
eval() runs a string as PHP code, so passing unsanitized user input to it lets attackers execute any server-side code they want.
Question 6: What does the `Content-Type` response header communicate to the browser?
- The media type (MIME type) of the response body (Correct answer)
- The length of the response in bytes
- The server software version
- The encoding algorithm used for compression
Correct answer: The media type (MIME type) of the response body
Content-Type tells the browser how to interpret the response body — for example, text/html renders as a webpage, application/json is parsed as JSON.
Question 7: Which mechanism allows a web server to push data to the browser without the browser making a new request?
- WebSockets (Correct answer)
- AJAX polling
- HTTP/1.1 keep-alive
- URL parameters
Correct answer: WebSockets
WebSockets establish a persistent, full-duplex connection that lets the server send data to the client at any time.
Web Programming Website And Web Server Programming 4
Which header in an HTTP response tells the browser how long to cache the response before revalidating?