CyberCertPrepWeb App FundamentalsFront-end vs Back-endEASYFree question
A developer stores user preferences in an HTTP cookie with the value encoded as JSON. The value is not signed. An attacker edits the cookie in their browser's DevTools and changes '{"theme":"light"}' to '{"theme":"dark","role":"admin"}'. What principle was violated?
- A.Cookies cannot store JSON; the encoding itself is the vulnerability
- B.The Secure and HttpOnly flags would have prevented this
- C.Never trust client-controlled data: data stored in cookies is fully accessible to the user and must be treated as untrusted input. If the value affects security decisions, it must be cryptographically signed (HMAC) or stored server-side
- D.JSON is vulnerable to injection attacks unlike other formats
Why C is correct
Cookies stored on the client can be read and modified by the user. Using unsigned client-side storage for any security-relevant data (roles, permissions, prices, user IDs) is a broken access control vulnerability. If the server trusts the cookie value directly, an attacker can simply edit it. Solutions: sign the cookie with HMAC (like Express's cookie-session), or store only an opaque session ID and keep the data server-side.
Know someone studying for Web App Fundamentals? Send them this one.