What component of a web application that stores the session state in a cookie an attacker can bypass?

The correct answer is D. An authorization check. An authorization check is a component of a web application that stores the session state in a cookie that can be bypassed by an attacker. An authorization check verifies that the user has the appropriate permissions to access the requested resources or perform the desired actions

Submitted by naveen.iyer· Mar 5, 2026Software Development Security

Question

Options

AAn initialization check
BAn identification check
CAn authentication check
DAn authorization check

How the community answered

(45 responses)

A
16% (7)
B
7% (3)
C
4% (2)
D
73% (33)

Explanation

An authorization check is a component of a web application that stores the session state in a cookie that can be bypassed by an attacker. An authorization check verifies that the user has the appropriate permissions to access the requested resources or perform the desired actions. However, if the session state is stored in a cookie, an attacker can manipulate the cookie to change the user's role or privileges, and bypass the authorization check. Therefore, it is recommended to store the session state on the server side, or use encryption and integrity protection for the cookie.

Topics

#Web application security#Session management#Authorization bypass

Community Discussion

No community discussion yet for this question.

Full CISSP Practice