Defensive Coding Against Broken Session Management CASENET Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An ASP.NET application has a session timeout of 30 minutes. The security team wants to reduce the session hijacking window to 10 minutes, but the business requires that users not be logged out while filling out a complex multi-step form that can take up to 25 minutes. The form does not make AJAX calls. What is the best solution?

   • ASet the session timeout to 10 minutes and store the form data in a hidden field on the client.
   • BSet the session timeout to 10 minutes and also set `slidingExpiration="true"`.
   • CKeep the session timeout at 30 minutes but add a JavaScript timer that refreshes the session every 9 minutes.
   • DReduce the session timeout to 10 minutes and rely on the user to resubmit the form.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An ASP.NET Core application uses cookie authentication. A security researcher demonstrates that an attacker can set a known session cookie before the user logs in, and after login the same cookie is used. What is the most effective mitigation?

   • ACall `HttpContext.SignOutAsync()` and then `HttpContext.SignInAsync()` with a new principal after authentication.
   • BCall `HttpContext.Session.Clear()` after authentication and then redirect.
   • CCall `HttpContext.SignInAsync()` with a new `ClaimsPrincipal` after authentication.
   • DCall `HttpContext.SignOutAsync()` before the login page loads.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Why is binding a session to the user's IP address considered a less reliable defense in modern web applications?

   • ABecause IP addresses are not unique to users
   • BBecause IP addresses can change due to mobile networks and proxies
   • CBecause IP addresses are encrypted in HTTPS
   • DBecause IP addresses are stored in cookies
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A .NET Core application is deployed behind a reverse proxy that terminates TLS. The application uses cookie-based sessions. The security team notices that the session cookie is not marked Secure, even though the application is accessed via HTTPS. The team wants to fix this without changing the proxy configuration. Which approach should be taken?

   • AUse `Cookie.HttpOnly = true` to force the browser to send the cookie only over HTTPS.
   • BConfigure the application to trust the X-Forwarded-Proto header and set `Cookie.SecurePolicy = CookieSecurePolicy.Always`.
   • CSet `Cookie.SecurePolicy = CookieSecurePolicy.SameAsRequest`.
   • DManually set the `Set-Cookie` header in every response.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In ASP.NET Core, which method is used to configure cookie settings for session management in the Startup or Program class?

   • Aservices.AddMvc(options => { ... })
   • Bservices.AddAuthentication(options => { ... })
   • Cservices.AddSession(options => { ... })
   • Dservices.AddControllers(options => { ... })
   Reveal Solution Discussion Select an answer first