Common Threats on Authentication and Authorization CASEJAVA Practice Questions (Page 9)

Questions 41–41

1. 41expert · hard

   A Java application uses a custom authentication filter that checks a token in the Authorization header. The filter does not validate the token's signature or expiration; it only checks that the token exists and is in the database. An attacker who obtains a valid token from a low-privileged user can modify the token's payload to claim admin privileges. What is the most effective fix that also maintains the current stateless authentication design?

   • AAdd a second token that is only known to the server and require both tokens in the header.
   • BUse a session-based authentication mechanism instead of tokens, but keep the same filter logic.
   • CStore the token in a database and compare the entire token string on every request, but do not add signature validation.
   • DUse a standard JWT library to sign and verify tokens with a strong algorithm, and validate the signature, expiration, and issuer on every request.
   Reveal Solution Discussion Select an answer first