The latest security scan of a web application reported multiple high vulnerabilities in session management. Which of the following is the BEST way to mitigate the issue?

Question

Options

• AProhibiting session hijacking of cookies
• BUsing secure cookie storage and transmission
• CPerforming state management on the server
• DUsing secure and HttpOnly settings on cookies

• A
  5% (1)
• B
  9% (2)
• C
  5% (1)
• D
  82% (18)

Explanation

The Secure flag on a cookie instructs the browser to only transmit the cookie over HTTPS, preventing it from being sent in plaintext over unencrypted connections where it could be intercepted. The HttpOnly flag prevents JavaScript from accessing the cookie via document.cookie, blocking cross-site scripting (XSS) attacks that attempt to steal session tokens. Together, these two attributes are the most direct and effective mitigations for common session management vulnerabilities. Option A (prohibiting session hijacking) is a goal, not a mechanism. Option B (secure cookie storage) is vague and partially overlaps with D. Option C (server-side state management) is a good practice for reducing session data exposure but does not directly address cookie transmission and access vulnerabilities.

No community discussion yet for this question.