CyberCertPrepWeb App FundamentalsCookies & SessionsEASYFree question
What does a cookie's 'Path' attribute set to '/' mean, and why might using a more specific path be beneficial?
- A.Path=/ means the cookie is sent with all requests to the domain. A more specific path (e.g., Path=/api/) means the cookie is only sent to matching paths, reducing exposure on pages that don't need it
- B.Path=/ means the cookie is only sent to the root URL homepage
- C.Path=/ means the cookie is encrypted for the root user
- D.Path is only used for session cookies and has no security relevance
Why A is correct
Path=/ is the broadest scope - the cookie is included in every request to the domain. For cookies only needed for specific functionality (e.g., a payment session cookie only relevant to /checkout/), using Path=/checkout/ means the cookie is not exposed on unrelated pages. This limits the blast radius of any XSS or logging vulnerability on other parts of the site.
Know someone studying for Web App Fundamentals? Send them this one.