Defensive Coding Against Broken Session Management CASEJAVA Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A Java application's logout function invalidates the session and clears the cookie. However, a penetration test shows that if an attacker captures the session ID before logout, they can still use it after logout because the server does not track invalidated session IDs. What is the most effective additional control?

   • AUse a JavaScript-based logout that clears all browser storage.
   • BBind the session to the user's IP and reject requests from different IPs.
   • CSet a very short absolute timeout, such as 2 minutes.
   • DMaintain a server-side denylist of invalidated session IDs and reject any request using them.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A Java application allows users to log in from multiple devices. The security team wants to detect if a session is being used from a different device without forcing re-login on every request. Which technique is most appropriate?

   • ABind the session to the IP address and invalidate if it changes.
   • BUse a short absolute timeout of 5 minutes.
   • CRegenerate the session ID on every request and require re-authentication if it changes.
   • DStore a device fingerprint (e.g., user-agent plus a client-generated token) in the session and compare it on each request.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A Java application currently generates session IDs using `UUID.randomUUID()`. A security audit requires session IDs to be unpredictable and resistant to brute-force. The team also wants to minimize the risk of session fixation. Which approach should be implemented?

   • AKeep UUID generation but add a server-side counter to make it unique.
   • BReplace UUID generation with `SecureRandom` to produce a 256-bit random value, encode it with Base64URL, and regenerate the session ID after login.
   • CUse the current timestamp and user ID as the session ID.
   • DUse `Math.random()` with a longer string to increase entropy.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A Java application uses a custom session management library that stores the session ID in a cookie and also in a JavaScript variable for AJAX requests. The application is HTTPS-only. A security review finds that the session ID is exposed in the browser's memory and could be stolen by an XSS payload. Which change is most effective?

   • AKeep the JavaScript variable but obfuscate the session ID with a custom encoding.
   • BSet the cookie's SameSite attribute to Lax to prevent XSS.
   • CRemove the JavaScript variable and use an HttpOnly cookie for session identification, with CSRF tokens for AJAX requests.
   • DUse a shorter session ID to reduce the impact of theft.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A Java web application allows users to log in with credentials. After successful authentication, the application currently continues to use the same session ID that was issued before login. A penetration test report flags this as a session fixation risk. Which defensive coding change should be implemented?

   • ACall request.changeSessionId() immediately after validating the user's credentials.
   • BStore the original session ID in a database and compare it on each request.
   • CAdd the session ID to the URL for all links after login.
   • DSet the session's maximum inactive interval to 30 minutes after login.
   Reveal Solution Discussion Select an answer first