Web Security

What terms are not usually used when it comes to authentication?

(multiple answers)

• AuthN

• AuthK

• AuthZ

• AuthM

What is the name of the most known industry standard for authentication protocols?

• AuthZ

• Bearer

• JWT

• OAuth 2.0

Authorization (AuthZ) means asking whether...

• ...the user is who they claim to be

• ...the user is allowed to do this

• ...the user is signed in

• ...the user would like to do something

You need to validate a JWT by asking the identity provider whether it is actually valid

• True

• False

CSRF stands for

• Cryptic-system Reconfiguration Framework

• Cognitive Signal Recognition Fraud

• Cookie Spoofing Redistribution Flaw

• Cross-site Request Forgery

What is not an attack vector of a CSRF attack?

• The user being authenticated on a vulnerable site

• The site using cookies without strict SameSite security

• The backend not setting CORS headers

• The site not using a CSRF token

What could lead to an XSS attack?

• A website rendering user input without validation

• A website not using HTTPS

• A website not checking for CORS headers

• A website not using brute-force preventions

How do you call the method of the validating user input to prevent XSS attacks?

• Cleaning

• Sanitization

• Desinfection

• Scanning

What is no advantage of client-side rendering?

• Higher performance through dynamic loading of content

• Lower development effort

• Static HTML site can be cached easily

• Less computing power needed for servers

Select the shown web architecture

• Server-side rendering

• Static Website

• Single Page Application

• Docker-shipping Website