A web application uses a cookies to track a client as it navigates through the pages that constitutes the application. Which code snippet can be used by the web application to reduce the chance of a…

The correct answer is A. cookie.setHttpOnly(true). When HTTPOnly flag is assigned to a cookie, the browser will restrict the access to such Cookie from Java Script code hence the cookie would only be sent to the subsequent request to server but cannot be accessed using client side script. In such a case even if website is…

Security

Question

A web application uses a cookies to track a client as it navigates through the pages that constitutes the application. Which code snippet can be used by the web application to reduce the chance of a cross-site scripting attack by setting some property of the cookie before returning it to the client?

Options

Acookie.setHttpOnly(true)
Bcookie.setMaxAge(3600)
Ccookie.setPath("/")
Dcookie.setSecure(true)

How the community answered

(45 responses)

A
73% (33)
B
16% (7)
C
7% (3)
D
4% (2)

Explanation

When HTTPOnly flag is assigned to a cookie, the browser will restrict the access to such Cookie from Java Script code hence the cookie would only be sent to the subsequent request to server but cannot be accessed using client side script. In such a case even if website is vulnerable to Cross Site Scripting (XSS) attacks, still the browser would safeguard the data stored into cookies flagged as HTTPOnly. Not D: If Secure flag is set for Cookie then it may only be transmitted over secure channel (SSL/HTTPS) ensuring that data is always encrypted while transmitting from client to server.

Topics

#HttpOnly cookie#XSS prevention#cookie security#cross-site scripting

Community Discussion

No community discussion yet for this question.

Full 1Z0-899 Practice