CyberCertPrepWeb App FundamentalsCookies & SessionsEASYFree question
A cookie is set with 'Path=/admin'. Which requests will the browser include this cookie in?
- A.Requests for /admin and any path that ends with /admin (e.g., /app/admin, /site/admin), with Path treated like a suffix match in the browser for each cookie in the jar
- B.Requests to /admin and any path that begins with /admin (e.g., /admin/, /admin/settings, /admin/users). The Path attribute is a prefix match, not an exact match
- C.Requests to exactly /admin (an exact match), and the browser omits the cookie for /admin/ and deeper paths like /admin/users on the same host, a rule that applies to each cookie with that attribute
- D.Requests to /admin and to the site root (e.g., /home), with Path being a hint that the browser skips for static files
Why B is correct
The cookie Path attribute uses prefix matching. A cookie with Path=/admin is sent for /admin, /admin/, /admin/settings, /admin/users/123. It is NOT sent for /other or /administrator (the path must match as a directory prefix). Important: Path is NOT a security boundary - JavaScript on /other can still read the cookie via document.cookie. Path is purely a client-side scoping hint, not access control. Use HttpOnly for security; Path for scope management.
Know someone studying for Web App Fundamentals? Send them this one.