CyberCertPrepWeb App FundamentalsCookies & SessionsEASYFree question
A web application stores user cart data in a cookie to support users who are not logged in. The cookie value is '{"items":["SKU-001"],"price":29.99}'. Why must the server recalculate the price at checkout?
- A.Cookies cannot store floating point numbers accurately
- B.The server must recalculate to account for currency exchange rates
- C.Cookie data is fully user-controlled; an attacker can modify the price field to any value (e.g., 0.01) before submitting checkout. The server must always recalculate prices from authoritative database records, not from client-supplied data
- D.This only matters if the cart cookie does not have the Secure flag
Why C is correct
Client-side data (cookies, localStorage, hidden fields, URL parameters) is always attacker-controlled. Storing price data on the client means any user can change it with browser DevTools or a proxy. The server must treat client data as untrusted input and always recalculate prices, discounts, and totals from the database. This is a classic business logic vulnerability.
Know someone studying for Web App Fundamentals? Send them this one.