Web Application Session Management GWAPT Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An online banking application allows users to log in from multiple devices. A user logs in on their desktop and then on their mobile phone. The application currently stores a single session token per user, so logging in on the mobile device invalidates the desktop session. Users are complaining that they are being logged out unexpectedly. The security team wants to maintain the ability to revoke a single device session without affecting others. Which approach should be implemented?

   • AStore the session token in a cookie with a long expiration and never invalidate it until the absolute timeout.
   • BIssue a unique session token for each device and maintain a session registry that maps tokens to devices, allowing individual revocation.
   • CRequire users to log in again on the desktop after using the mobile app, and disable concurrent sessions.
   • DUse the same session token across all devices and rely on the last activity timestamp to expire idle sessions.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A web application is deployed behind a load balancer that terminates TLS. The application sets a session cookie without the Secure flag because the connection between the load balancer and the application server is HTTP. A security review flags this as a risk. Which change should be made to ensure the cookie is only sent over HTTPS?

   • AUse a JavaScript check to only send the cookie when the page is loaded over HTTPS.
   • BSet the cookie's Domain attribute to the load balancer's IP address.
   • CSet the Secure flag on the cookie and configure the application to trust the X-Forwarded-Proto header to detect HTTPS requests.
   • DRemove the Secure flag and rely on HSTS to force HTTPS.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A development team is designing a new web application and wants to follow OWASP session management best practices. Which combination of controls should be implemented to provide a strong session management foundation?

   • AUse a single global session ID for all users and rotate it daily.
   • BUse a predictable session ID based on a user ID and timestamp, and set a long cookie expiration to avoid frequent logins.
   • CStore the session ID in a URL parameter and rely on HTTPS to protect it.
   • DUse a cryptographically secure random generator for session IDs, set the Secure and HttpOnly flags, and implement idle and absolute timeouts.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A web application allows users to have multiple concurrent sessions (e.g., on different devices). A security requirement states that a user must be able to revoke a specific session without logging out other sessions. Which of the following is the most appropriate design?

   • AClear the cookie on the user's browser and rely on that to revoke the session.
   • BUse a single session token that is shared across all devices.
   • CSet a short absolute timeout that forces re-authentication on all devices.
   • DMaintain a server-side session registry with unique session IDs and allow users to delete individual session records.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Why is storing a session token in a URL considered insecure?

   • AURLs are limited to 2048 characters
   • BURLs cannot be bookmarked
   • CURLs are encrypted by default
   • DURLs are often logged by browsers, proxies, and web servers
   Reveal Solution Discussion Select an answer first