CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  To limit the cookie to a specific path

  Why it's wrong here

  This statement is incorrect. The "Path" attribute of a cookie is responsible for limiting its scope to a specific URL path within the domain, meaning the browser will only send the cookie if the requested URL path matches or is a subdirectory of the specified path. In contrast, the "SameSite" attribute governs whether a cookie should be sent with cross-site requests, focusing on the origin of the request rather than the specific path on the server.

• ✗

  To encrypt the cookie value

  Why it's wrong here

  This statement is incorrect. The "SameSite" attribute does not provide any encryption for the cookie's value. Its function is solely to control the circumstances under which a browser sends a cookie with a request, specifically concerning cross-origin contexts. Encryption of cookie values, if desired, must be implemented by the server-side application before setting the cookie, ensuring confidentiality of the data stored within it.

• ✓

  To prevent the cookie from being sent in cross-origin requests, mitigating CSRF

  Why this is correct

  This statement is correct. The "SameSite" attribute is designed to prevent a browser from sending a cookie with requests initiated from a different origin than the site that set the cookie. By restricting the automatic inclusion of session cookies in cross-origin requests, it significantly mitigates Cross-Site Request Forgery (CSRF) attacks, where an attacker tricks a user's browser into sending an authenticated request to a vulnerable web application without their explicit consent. This defense ensures that sensitive actions require a same-site context.

• ✗

  To restrict the cookie to HTTPS connections only (Secure flag)

  Why it's wrong here

  This statement is incorrect. The "Secure" attribute is specifically used to instruct the browser to send a cookie only over encrypted HTTPS connections, preventing its transmission over insecure HTTP. This protects the cookie's confidentiality during transit. The "SameSite" attribute, however, addresses a different security concern by controlling whether a cookie is sent with requests originating from a different site, regardless of the connection's encryption status.

Go deeper

Related to this question