Session Security & Business Logic GWEB Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A web application stores the user's role and permissions in a server-side session, but the session ID is stored in a cookie. The application also has a feature that allows users to change their role via a hidden form field. A penetration tester discovers that the application trusts the role value from the session without verifying it against a server-side authorization policy. Which of the following is the most effective remediation?

   • AAdd a hidden field to the form that contains the user's role and validate it on the server.
   • BSign the session data with a server-side secret to prevent tampering.
   • CRemove the role from the session and always derive authorization from a server-side directory or database on each request.
   • DEncrypt the session data so that the client cannot read or modify it.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is a common mistake that leads to unauthorized access despite having session-based access control?

   • ARegenerating the session ID after login
   • BRelying on client-supplied values (e.g., hidden fields) to determine access rights
   • CUsing a strong session ID
   • DSetting the HttpOnly attribute on the session cookie
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security tester is performing a session management review of a web application. Which of the following tests is most likely to reveal a session fixation vulnerability?

   • ACheck if the session cookie has the Secure and HttpOnly attributes.
   • BLog in with a known session ID and then check if the session ID changes after authentication.
   • CIntercept the session cookie and replay it from a different IP address.
   • DSend multiple requests with different session IDs and observe the response times.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A multi-tenant SaaS application stores the tenant ID in the session cookie. A penetration test reveals that changing the tenant ID in the cookie allows a user to access another tenant's data. The application does not validate that the tenant ID matches the authenticated user's membership. Which remediation is most effective?

   • AUse a longer random tenant ID to make guessing harder.
   • BAdd a checksum to the cookie to detect tampering.
   • CEncrypt the cookie so the tenant ID cannot be read or modified.
   • DStore the tenant ID only on the server-side session and never trust client-supplied tenant identifiers.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A web application uses IP binding to detect session hijacking. Users on mobile networks frequently change IP addresses, causing legitimate sessions to be terminated. Which approach preserves security while reducing false positives?

   • ARemove IP binding entirely and rely on the session timeout.
   • BBind to the user's IP prefix (e.g., /24) instead of the full IP.
   • CIncrease the session timeout to reduce the impact of IP changes.
   • DUse IP binding as a risk indicator rather than a hard rule, and require re-authentication when the IP changes.
   Reveal Solution Discussion Select an answer first