Sessions and Cookies

Cookies are stored...

• on the client

• on the server

Same Origin Policy (SOP) means a server cannot set cookies for a different domain.

• FALSE

• TRUE

Third-Party Cookies...

• breach SOP

• work around SOP

• breach SOP, but must ask for consent

If a cookie's expiry date is not set, it defaults to...

• 1 day

• the current time (the cookie is not saved)

• forever (the cookie does not expire)

• the end of the session

Cookies cannot be accessed by Javascript.

• TRUE

• FALSE

Cookies can be accessed by CSS.

• TRUE

• FALSE

Session cookies expire...

• after each request

• after each response

• when the user closes the browser

• when the expiry date set in the cookie is reached

The best approach to steal someone else's cookies is...

• to monitor requests and responses at application level

• to sniff packets at network level

Strong session IDs...

• can be ordered

• are predictable

• have high entropy

• are sequential

Web application firewalls (WAF) sit between the client and the application server

• on the server side

• on the client side

• on both server and client sides

• it depends on the browser