CyberCertPrepWeb App FundamentalsCookies & SessionsEASYFree question
A cookie is set with 'Path=/admin'. Which requests will the browser include this cookie in?
- A.Only requests to the exact path /admin - not /admin/ or /admin/settings
- B.All requests to the domain, regardless of path
- C.Requests to the /admin path and its parent paths (/, /ad)
- D.Requests to /admin and any path that begins with /admin (e.g., /admin/, /admin/settings, /admin/users). The Path attribute is a prefix match, not an exact match
Why D is correct
The cookie Path attribute uses prefix matching. A cookie with Path=/admin is sent for /admin, /admin/, /admin/settings, /admin/users/123. It is NOT sent for /other or /administrator (the path must match as a directory prefix). Important: Path is NOT a security boundary - JavaScript on /other can still read the cookie via document.cookie. Path is purely a client-side scoping hint, not access control. Use HttpOnly for security; Path for scope management.
Know someone studying for Web App Fundamentals? Send them this one.