AJAX Technologies and Security Strategies GWEB Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A developer is building an AJAX-driven comment form. The form accepts a `message` field and displays it in a `<div>` using `innerHTML`. The team wants to prevent XSS while keeping the ability to render basic formatting like bold text. Which approach is MOST secure?

   • AUse a regex to remove `<script>` tags and allow all other HTML.
   • BEscape the entire message and display it as plain text, losing all formatting.
   • CUse a well-tested sanitization library on the client side to strip dangerous HTML and keep only safe tags.
   • DRender the message inside an `<iframe sandbox>` without `allow-scripts`.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security team is reviewing logs for an AJAX endpoint that returns customer records. They notice a pattern where a single user session requests the same record ID hundreds of times in a short period, but each request uses a different `X-Requested-With` header value. What is the most likely attack and what log-based detection is most effective?

   • AThe user is performing a CSRF attack; detect by checking the `Origin` header.
   • BThe user is scraping data; detect by correlating session ID with high request volume for distinct record IDs.
   • CThe user is testing for SQL injection; detect by looking for error messages in responses.
   • DThe user is a legitimate power user; no action is needed.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A developer is building a dashboard that polls a server every 5 seconds using AJAX to display real-time metrics. The server returns a JSON payload. The developer notices that the browser sometimes shows stale data because responses arrive out of order. Which approach ensures the dashboard always displays the latest data?

   • AUse `XMLHttpRequest` with `async: false` to block the UI until the response arrives.
   • BUse `JSON.parse` on the response and compare timestamps before rendering.
   • CIncrease the polling interval to 10 seconds.
   • DUse the `fetch` API with an `AbortController` to cancel the previous request before sending a new one.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A web application exposes an AJAX endpoint that returns user search results. The endpoint accepts a `q` parameter and returns JSON. A tester found that submitting `q=<script>alert(1)</script>` causes the script to execute in the browser. The application uses a modern framework that escapes data when rendering. What is the most likely cause and the best fix?

   • AThe endpoint reflects the input in the JSON response without output encoding; the fix is to encode the response data as JSON and set `Content-Type: application/json`.
   • BThe endpoint is vulnerable to SQL injection; the fix is to use parameterized queries.
   • CThe endpoint is vulnerable to CSRF; the fix is to add a CSRF token.
   • DThe framework's auto-escaping is disabled; the fix is to re-enable it.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company's web application uses AJAX to submit user profile updates to a REST API. The API endpoint accepts JSON and updates the user's email address. A penetration test revealed that an attacker can submit a request with a different `userId` in the JSON body and change another user's email. The application uses session cookies for authentication. Which control should be added to prevent this?

   • ARequire the `userId` to match a value stored in a hidden form field.
   • BUse HTTPS and ensure the response does not include the new email address.
   • CAdd a CSRF token to the AJAX request and validate it on the server.
   • DIgnore the `userId` from the request body and derive the user identity from the authenticated session.
   Reveal Solution Discussion Select an answer first