Designing interfaces and user experiences →hardMultiple ChoiceObjective-mapped

SNOW-CAD Designing interfaces and user experiences Practice Question

Exhibit

// Widget Client Controller
function($scope, $http) {
    $http.get('/api/now/table/incident?sysparm_limit=10').then(function(response){
        $scope.data = response.data.result;
    });
}

Refer to the exhibit. What security risk is present in this implementation?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The data is not subject to the same ACLs as server-side calls

Using client-side $http calls bypasses the server-side ACL evaluation that occurs when using spUtil or server scripts. Client-side REST API calls still respect ACLs based on the user's session, but they may expose sensitive data that goes through different security checks. However, a more critical risk is that the endpoint might be susceptible to CSRF if not protected. In the context of Service Portal, the recommended approach is to use spUtil.get or a server script to ensure proper data access control. Option D highlights the risk of inconsistent ACL enforcement.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The request exposes internal API credentials
Why it's wrong here
Incorrect: Credentials are not exposed in client-side code.
✗
The endpoint does not require authentication
Why it's wrong here
Incorrect: The endpoint uses session authentication.
✗
The client exposes the widget to XSS attacks
Why it's wrong here
Incorrect: This is not inherent to the $http call.
✓
The data is not subject to the same ACLs as server-side calls
Why this is correct
Correct: Client-side REST calls may have different ACL behavior than server GlideRecord queries.

Visual reference

Go deeper

SNOW-CAD Designing interfaces and user experiences Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question