GWAPT · Question #114
Which session attribute helps prevent session hijacking?
The correct answer is D. All of the above. All three flags address different attack vectors used in session hijacking, which is why D is correct - no single flag alone provides complete protection. The Secure flag ensures cookies are transmitted only over HTTPS, blocking interception by a network eavesdropper…
Question
Which session attribute helps prevent session hijacking?
Options
- ASecure flag
- BHttpOnly flag
- CSameSite flag
- DAll of the above
How the community answered
(32 responses)- A3% (1)
- B3% (1)
- C13% (4)
- D81% (26)
Explanation
All three flags address different attack vectors used in session hijacking, which is why D is correct - no single flag alone provides complete protection. The Secure flag ensures cookies are transmitted only over HTTPS, blocking interception by a network eavesdropper (man-in-the-middle). The HttpOnly flag hides cookies from JavaScript, neutralizing XSS attacks that would otherwise steal the session token via document.cookie. The SameSite flag restricts cookies from being sent on cross-origin requests, defending against CSRF-based session abuse. Choosing A, B, or C alone is incomplete because each covers only one attack surface, leaving the others exposed.
Memory tip: Think S-H-S - Secure locks the wire, HttpOnly locks the script, SameSite locks the origin. You need all three locks on the door.
Community Discussion
No community discussion yet for this question.