Secure Coding Practices

Preview — 3 of 10 questions

What will happen when a user clicks this link?

javascript

<a href="https://example.com/search?query=<img src=x onerror='alert(\"Hacked\")'">
  Search
</a>

AThe search page displays normally.

BNothing happens; the link is invalid.

CThe browser prevents the navigation.

DAn alert box with "Hacked" pops up.

What security vulnerability exists in this code?

javascript

// Backend: Save user comment to database
app.post("/comment", (req, res) => {
  const comment = req.body.comment;
  database.save({ comment: comment }); // Stored as-is
  res.json({ success: true });
});

// Frontend: Display all comments
app.get("/comments", (req, res) => {
  const comments = database.getAll();
  let html = "<div>";
  comments.forEach(c => {
    html += `<p>${c.comment}</p>`; // Directly inserted into HTML
  });
  html += "</div>";
  res.send(html);
});

ANo vulnerability; the code is secure.

BSQL injection vulnerability.

CCSRF vulnerability.

DStored XSS vulnerability.

Which approach correctly prevents CSRF attacks?

javascript

// Server generates token
app.get("/transfer-form", (req, res) => {
  const token = generateRandomToken();
  req.session.csrfToken = token;
  res.send(`
    <form method="POST" action="/transfer">
      <input type="hidden" name="csrf_token" value="${token}">
      <input type="text" name="amount">
      <button type="submit">Transfer</button>
    </form>
  `);
});

// Server validates token
app.post("/transfer", (req, res) => {
  if (req.body.csrf_token !== req.session.csrfToken) {
    return res.status(403).json({ error: "Invalid CSRF token" });
  }
  
  // Process transfer
  processTransfer(req.body.amount);
  res.json({ success: true });
});

AOnly accepting POST requests (no GET requests).

BUsing a CSRF token generated per session and validated on state-changing requests.

CChecking the Referer header.

DUsing HTTPS (encryption is enough).

Answer all 10 questions (7 more), see explanations for every answer, and track your score.