Common Threats on User Authentication and Authorization CASENET Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A web application uses token-based authentication with JWTs stored in localStorage. A security review identifies that the JWT is not signed with a strong algorithm. An attacker can modify the token's payload to change the role from 'User' to 'Admin'. What is the most effective mitigation?

   • AStore the JWT in an HttpOnly cookie instead of localStorage.
   • BEncode the token payload with Base64.
   • CUse a strong signing algorithm, such as RS256, and validate the signature on every request.
   • DUse a shorter token expiration time.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company is designing a new web application that will handle sensitive customer data. The security architect must choose an authentication mechanism that resists session hijacking and credential theft while also supporting single sign-on across multiple internal applications. The organization already uses Active Directory. Which approach is most appropriate?

   • AUse integrated Windows authentication with Kerberos and enable token binding
   • BUse form-based authentication with cookies and no additional protections
   • CUse API keys stored in the browser's local storage
   • DUse basic authentication over HTTPS
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A user changes a numeric ID in the URL from 'profile?id=100' to 'profile?id=101' and views another user's private data. Which authorization threat does this represent?

   • ASession fixation
   • BPrivilege escalation
   • CForced browsing
   • DInsecure Direct Object Reference (IDOR)
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security auditor is reviewing an application that uses role-based access control. The auditor finds that a user with the 'Viewer' role can access an administrative function by directly entering the URL. The application's menu does not show the admin link to viewers. Which control is missing?

   • AA CAPTCHA on the admin page
   • BServer-side authorization checks on the administrative function
   • CClient-side JavaScript to hide the admin link
   • DA longer session timeout
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A content management system allows authors to edit their own articles. The application uses a role-based access control (RBAC) system where the 'Author' role can edit articles they own, and the 'Editor' role can edit any article. A bug is discovered: any authenticated user can send a POST request to the edit endpoint with an article ID and the system does not check ownership. The application also has an admin panel that is not linked in the UI but is accessible by guessing the URL. Which two authorization flaws are present?

   • ACredential stuffing and brute force
   • BIDOR on the edit endpoint and forced browsing to the admin panel
   • CMissing function-level access control and session fixation
   • DPrivilege escalation and session hijacking
   Reveal Solution Discussion Select an answer first