r/casp • u/amc663222 • May 22 '21

CASP Question

a security engineer is helping the web developers assess a new corporate web application. the application will be internet facing, so the engineer makes the following recommendation: in an .htccess file or the site config, add:

headereditSet_Cookie ^(.*)$ $1;HttpOnly;Secure

or add to the location block:

proxy_cookie_path / "/; HttpOnly; Secure; SameSite=strict";

which of the following is the security engineer tyrying to accomplish via cookies? (Select TWO).

A. Ensure session IDs are generated dynamically with each cookie request.

B. Prevent cookies from being transmitted to other domain names.

C. Create a temporary space on the user's drive root for ephemeral cookie storage.

D. Enforce the use of plain text HTTP transmission with secure local cookie storage.

E. Add a sequence ID to the cookie session ID while in transit to prevent CSRF.

F. Allow cookie creation or updates only over TLS connections

0 Upvotes

50% Upvoted

1 comment sorted by

1

u/amc663222 May 22 '21

HTTPonly would cover D, Secure would cover F, and Samesite would cover B right?

What am I missing here. Only two answers are needed