CyberCertPrepWeb App FundamentalsHTTP & Web BasicsEASYFree question
During HTTP content negotiation, a client sends 'Accept: text/html;q=0.9, application/json;q=1.0, */*;q=0.5'. What will the server prefer to return, and what does 'q' represent?
- A.q stands for 'quantity' and limits the number of response objects the server can return
- B.q is a quality factor (preference weight) from 0 to 1.0; the server should prefer 'application/json' (q=1.0, highest) over 'text/html' (q=0.9), with any other type (q=0.5) as a last resort
- C.q stands for 'quota' and enforces a byte limit per content type
- D.The server always returns text/html regardless of the Accept header; q values only affect image formats
Why B is correct
The Accept header's q (quality) factor ranges from 0 (unacceptable) to 1.0 (highest preference), defaulting to 1.0 if omitted. The server should respond with the highest-quality match it can produce. In this example: application/json (q=1.0) > text/html (q=0.9) > anything else (q=0.5). If the server can produce JSON, it should. Security relevance: some applications behave differently depending on the accepted content type - serving JSON to API clients and HTML to browsers. Attackers can exploit content-type switching to get responses in formats that bypass WAF rules or expose different data fields.
Know someone studying for Web App Fundamentals? Send them this one.