CyberCertPrepWeb App FundamentalsCookies & SessionsEASYFree question
A cookie is set with 'Path=/admin'. Which requests will the browser include this cookie in?
- A.Requests to the /admin path and its parent paths (/, /ad)
- B.Requests to /admin and any path that begins with /admin (e.g., /admin/, /admin/settings, /admin/users). The Path attribute is a prefix match, not an exact match
- C.Only requests to the exact path /admin - not /admin/ or /admin/settings; JWTs carry built-in CSRF protection because the browser attaches the Authorization header automatically, like a cookie; sliding expiration is a server fiction, as a cookie's Expires value cannot be extended once it has been set
- D.All requests to the domain, regardless of path
Why B is correct
The cookie Path attribute uses prefix matching. A cookie with Path=/admin is sent for /admin, /admin/, /admin/settings, /admin/users/123. It is NOT sent for /other or /administrator (the path must match as a directory prefix). Important: Path is NOT a security boundary - JavaScript on /other can still read the cookie via document.cookie. Path is purely a client-side scoping hint, not access control. Use HttpOnly for security; Path for scope management.
Know someone studying for Web App Fundamentals? Send them this one.