CyberCertPrepWeb App FundamentalsFront-end vs Back-endEASYFree question

A developer implements client-side feature flags by checking a variable like 'window.FEATURES.ADMIN_PANEL = true'. A tester enables the admin panel by running this in the browser console. What is the core security issue?

A.Client-side feature flags are a UI convenience only; any server-side actions performed when the admin panel is shown must independently authorize the user - the flag itself provides no access control
B.Feature flags should only be stored in localStorage, not window
C.The issue is that window variables are global and visible to other browser tabs
D.Feature flags in JavaScript violate the Same-Origin Policy

Why A is correct

Feature flags control UI rendering, not authorization. An attacker can always manipulate client-side JavaScript to enable hidden UI elements. If clicking a visible admin button sends a request to /api/admin/action, the server must validate the user's role on every request. Client-side flags are for progressive rollouts and A/B testing - never for access control.

Know someone studying for Web App Fundamentals? Send them this one.

A developer implements client-side feature flags by checking a variable like 'window.FEATURES.ADMIN_PANEL = true'. A tester enables the admin panel by running this in the browser console. What is the core security issue?

Where this fits in the Web App Fundamentals exam

One question down. Thousands to go.

A developer implements client-side feature flags by checking a variable like 'window.__FEATURES__.ADMIN_PANEL = true'. A tester enables the admin panel by running this in the browser console. What is the core security issue?

Where this fits in the Web App Fundamentals exam

More free Front-end vs Back-end questions

One question down. Thousands to go.

A developer implements client-side feature flags by checking a variable like 'window.FEATURES.ADMIN_PANEL = true'. A tester enables the admin panel by running this in the browser console. What is the core security issue?