Secure cookie attributes in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding the Secure attribute in cookies

What is the main purpose of the Secure attribute in HTTP cookies?

A It ensures the cookie is only sent over encrypted HTTPS connections.

B It makes the cookie accessible only to JavaScript on the client side.

C It restricts the cookie to be sent only to the domain that set it.

D It sets an expiration date for the cookie to automatically delete.

💡 Hint

Think about how data security is maintained during transmission.

The Secure attribute tells the browser to send the cookie only over HTTPS connections, protecting it from being sent over unencrypted HTTP where it could be intercepted.

📋 Factual

intermediate

Role of HttpOnly attribute in cookies

Which of the following best describes the effect of the HttpOnly attribute on a cookie?

A It allows the cookie to be shared across different domains.

B It encrypts the cookie content to protect it from being read by the server.

C It prevents the cookie from being accessed by client-side scripts like JavaScript.

D It makes the cookie persistent even after the browser is closed.

💡 Hint

Consider how to protect cookies from malicious scripts running in the browser.

The HttpOnly attribute prevents client-side scripts from accessing the cookie, reducing the risk of cross-site scripting (XSS) attacks stealing cookie data.

🔍 Analysis

advanced

Impact of SameSite attribute on cookie behavior

How does setting the SameSite=Strict attribute affect cookie transmission?

A The cookie is sent with all requests, including cross-site requests.

B The cookie is sent only with requests originating from the same site, blocking cross-site requests.

C The cookie is sent only with cross-site requests, not same-site requests.

D The cookie is deleted immediately after the session ends.

💡 Hint

Think about how websites prevent cross-site request forgery (CSRF) attacks.

SameSite=Strict restricts cookies to be sent only with requests from the same site, preventing them from being sent with cross-site requests and thus reducing CSRF risks.

❓ Comparison

advanced

Difference between SameSite=Lax and SameSite=Strict

Which statement correctly compares SameSite=Lax and SameSite=Strict cookie settings?

A SameSite=Lax allows cookies on some cross-site top-level navigations, while SameSite=Strict blocks all cross-site cookie sending.

B SameSite=Strict allows cookies on some cross-site navigations, while SameSite=Lax blocks all cross-site cookie sending.

C Both settings allow cookies on all cross-site requests without restrictions.

D SameSite=Lax deletes cookies after 24 hours, SameSite=Strict deletes after session ends.

💡 Hint

Consider how each setting balances usability and security.

SameSite=Lax is less strict and allows cookies on top-level navigations like clicking a link from another site, while SameSite=Strict blocks cookies on all cross-site requests.

❓ Reasoning

expert

Choosing secure cookie attributes for a banking website

A banking website wants to protect user session cookies from theft and cross-site attacks. Which combination of cookie attributes provides the strongest protection?

A Secure, SameSite=None

B HttpOnly, SameSite=Lax

C SameSite=Strict only

D Secure, HttpOnly, SameSite=Strict

💡 Hint

Think about encryption, script access, and cross-site request protections together.

Using Secure ensures cookies are sent only over HTTPS, HttpOnly prevents JavaScript access, and SameSite=Strict blocks cross-site requests, together providing strong protection for sensitive session cookies.