Web Application Session Management GWAPT Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   According to OWASP, which is a recommended session management practice?

   • AStore session IDs in the URL to avoid cookie issues
   • BUse a secure random algorithm to generate session IDs
   • CUse the user's IP address as part of the session ID
   • DSet a very long session timeout to improve user experience
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which mitigation is most effective against session hijacking via XSS?

   • AUsing a longer session ID
   • BRegenerating the session ID on each request
   • CSetting the HttpOnly flag on session cookies
   • DUsing a custom header for the session token
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A healthcare portal must balance usability with security. Users often leave their workstations unattended, and the compliance team requires that sessions expire after 15 minutes of inactivity. However, clinicians complain that they are frequently logged out while reviewing long patient records. The application currently has a single absolute timeout of 30 minutes. Which approach best satisfies both the inactivity requirement and the need for long uninterrupted work sessions?

   • ARemove the absolute timeout and rely solely on the 15-minute idle timeout.
   • BImplement a 15-minute idle timeout and a separate absolute timeout of 8 hours, and prompt the user to confirm activity before extending the session.
   • CUse a 15-minute idle timeout only for administrative users and a 60-minute idle timeout for clinicians.
   • DSet both idle and absolute timeouts to 30 minutes, but allow the user to click a 'keep alive' button.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A web application allows users to open multiple tabs in the same browser. When a user logs out in one tab, the other tabs continue to function because the session cookie is still present. The security team wants to ensure that logging out in any tab invalidates the session across all tabs. Which approach should be implemented?

   • AInvalidate the server-side session on logout and use a shared session state that all tabs reference, so subsequent requests in other tabs fail.
   • BUse a different session ID for each tab and invalidate only the tab that initiated logout.
   • CSet a short idle timeout so that other tabs expire quickly after logout.
   • DUse JavaScript to clear the cookie in all tabs by iterating over window objects.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A web application allows users to post comments that are displayed to other users. A security researcher discovers that the application is vulnerable to stored XSS, which can be used to steal session cookies. The application currently sets the session cookie without the HttpOnly flag. Which two changes would most effectively mitigate the impact of this XSS vulnerability?

   • ABind the session to the user's IP address and reject mismatches.
   • BSet the Secure flag on the session cookie and use a Content Security Policy.
   • CSet the HttpOnly flag on the session cookie and implement proper output encoding for user-generated content.
   • DUse a short session timeout and rotate the session ID every 5 minutes.
   Reveal Solution Discussion Select an answer first