GSEC · Question #121
How often is session information sent to the web server from the browser once the session information has been established?
The correct answer is A. With any change in session data. Session information is transmitted to the web server from the browser when session data has changed, not on every request or only at initialization.
Question
How often is session information sent to the web server from the browser once the session information has been established?
Options
- AWith any change in session data
- BWith every subsequent request
- CWith any hidden form element data
- DWith the initial request to register the session
How the community answered
(43 responses)- A79% (34)
- B7% (3)
- C2% (1)
- D12% (5)
Why each option
Session information is transmitted to the web server from the browser when session data has changed, not on every request or only at initialization.
In stateful web session management, updated session data is sent back to the server when the session state changes - while a session identifier token accompanies every request, the actual session data payload is triggered by modifications to session state, making change-driven transmission the defining behavior.
While the session identifier cookie is sent with every request, the full session data is not retransmitted on each request - conflating the session token with full session data transmission is the error here.
Hidden form elements are one mechanism for passing data between pages but are not the standard method for transmitting established session information back to the web server.
The initial request creates or registers the session, but the question specifically asks about transmission behavior after the session has already been established.
Concept tested: Web session data transmission and state management
Source: https://owasp.org/www-community/controls/SecureSessionManagement
Topics
Community Discussion
No community discussion yet for this question.