Defensive Coding Against Broken Session Management CASEJAVA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A Java web application currently uses URL rewriting as a fallback when cookies are disabled. A security audit requires that session IDs never appear in URLs, logs, or referrer headers. Which configuration change should be made?

   • AKeep URL rewriting but encode the session ID using Base64.
   • BDisable URL rewriting by configuring the session tracking mode to COOKIE only in web.xml.
   • CUse a filter to strip the session ID from the referrer header on every response.
   • DSet the session cookie's Secure attribute and rely on HTTPS.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Java web application allows users to log in with a username and password. After successful authentication, the application stores the user's role in the session and redirects to a dashboard. A security review finds that an attacker can force a victim to use a known session ID before login, and after login the session ID remains the same. Which combination of controls should be implemented to mitigate this issue?

   • ABind the session to the user's IP address and reject any request from a different IP.
   • BUse a longer session ID and store it in a hidden form field.
   • CStore the session ID in a JavaScript-readable cookie and rotate it every request.
   • DRegenerate the session ID immediately after authentication and configure an idle timeout.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A Java application stores the session ID in a cookie and also in `localStorage` for use by a JavaScript single-page application. A security review identifies that an XSS vulnerability could allow an attacker to read the session ID from `localStorage`. What is the best remediation?

   • AUse a shorter session ID to reduce the impact of theft.
   • BRemove the session ID from `localStorage` and rely solely on the HttpOnly cookie.
   • CKeep the session ID in `localStorage` but encrypt it with a client-side key.
   • DSet the cookie's SameSite attribute to Strict.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of session management in a web application?

   • ATo authenticate the user on every single request
   • BTo encrypt all data transmitted between the client and the server
   • CTo store the user's password securely on the server
   • DTo maintain state across multiple HTTP requests from the same user
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A Java web application is deployed behind a load balancer that terminates TLS. The application sets the session cookie without the Secure attribute because it sees HTTP on the internal connection. What is the best way to ensure the cookie is marked Secure?

   • AUse a JavaScript redirect to add the Secure attribute.
   • BDisable TLS termination at the load balancer and use end-to-end TLS.
   • CConfigure the application to trust the `X-Forwarded-Proto` header and set the Secure flag based on the original request scheme.
   • DSet the Secure flag manually in code for all cookies.
   Reveal Solution Discussion Select an answer first