Defensive Coding Against Broken Session Management CASENET Practice Questions (Page 8)

Questions 36–38

1. 36application · medium

   A developer is reviewing the login flow of an ASP.NET MVC application. The current flow creates a session when the user first visits the site, and after successful authentication the same session ID is used. The security team wants to prevent session fixation. What is the most effective change to the login flow?

   • ASet `SessionIDManager` to use a fixed session ID for authenticated users.
   • BCall `Session.Abandon()` after authentication and then redirect to a page that creates a new session.
   • CCall `Session.Clear()` after authentication and then redirect to the home page.
   • DCall `Session.Abandon()` before the login page loads.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which .NET API should be used to generate a cryptographically strong random session identifier?

   • ASystem.Random.Next()
   • BSystem.Environment.TickCount.ToString()
   • CSystem.Security.Cryptography.RandomNumberGenerator.GetBytes()
   • DSystem.Guid.NewGuid().ToString()
   Reveal Solution Discussion Select an answer first
3. 38application · medium

   A developer is implementing a custom session ID generator for a .NET application. The current implementation uses `Guid.NewGuid().ToString()` as the session ID. A security review recommends using a cryptographically secure random generator instead. Which code change should be made?

   • AUse `Random.Next(100000, 999999)` and store it as an integer.
   • BUse `Guid.NewGuid().ToString("N")` to remove hyphens.
   • CUse `RandomNumberGenerator.GetBytes(32)` and convert to a base64 string.
   • DUse `Environment.TickCount.ToString()` as the session ID.
   Reveal Solution Discussion Select an answer first