Cross Origin Policy Attacks and Mitigation GWEB Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A web application at https://api.example.com returns JSON data for authenticated users. The development team added the following response header to allow a partner dashboard at https://partner.example.com to read the data: Access-Control-Allow-Origin: https://partner.example.com. A security review notes that the application also reflects the Origin header when it matches a hardcoded list of trusted origins. Which additional header is required to make the partner dashboard's cross-origin requests work without exposing credentials to untrusted origins?

   • AAccess-Control-Allow-Headers: Content-Type
   • BAccess-Control-Allow-Methods: GET, POST
   • CAccess-Control-Allow-Credentials: true
   • DAccess-Control-Expose-Headers: X-Request-Id
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   How does an anti-CSRF token mitigate CSRF attacks?

   • AIt requires the user to re-authenticate for every state-changing request.
   • BIt blocks all cross-origin requests by setting the SameSite attribute on cookies.
   • CIt adds a secret, unpredictable value to forms or requests that the server validates to ensure the request originated from the legitimate site.
   • DIt encrypts the session cookie so that the server can verify the user's identity.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An API is used by two trusted partner applications: one at https://partner1.example.com and one at https://partner2.example.com. The API does not use cookies; clients authenticate with a bearer token in the Authorization header. What is the most secure CORS configuration for this API?

   • AAllow all origins with Access-Control-Allow-Origin: * because the API uses bearer tokens.
   • BSet Access-Control-Allow-Origin to https://partner1.example.com and https://partner2.example.com.
   • CDynamically return the Origin header only if it matches one of the two partner origins.
   • DReflect the Origin header and set Access-Control-Allow-Credentials to true.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following is an example of an attack that bypasses or abuses cross-origin policies?

   • AA denial-of-service attack that overwhelms a server with requests.
   • BA phishing attack that tricks users into entering credentials on a fake website.
   • CA DNS rebinding attack that causes the browser to send requests to a different IP address while maintaining the same hostname.
   • DA SQL injection attack that extracts data from a database.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A web page at https://shop.example.com makes an XMLHttpRequest to https://api.example.com/data. The response contains sensitive JSON. The API does not send any CORS headers. What will the browser do?

   • ABlock the request only if the response contains JSON.
   • BAllow the request and expose the response to JavaScript.
   • CSend the request but block JavaScript from reading the response.
   • DBlock the request entirely, preventing it from reaching the API.
   Reveal Solution Discussion Select an answer first