All quizzesHard
Security Architecture
Preview — 3 of 10 questions
What is Mutation XSS (mXSS) and how does it bypass HTML parsers?
javascript
<!-- Server-side sanitization removes script tags -->
<!-- Input: <noscript><p title="</noscript><img src=x onerror=alert('hacked')>"></p></noscript> -->
<!-- Server sanitizes and outputs: <noscript><p title="</noscript><img src=x onerror=alert('hacked')>"></p></noscript> -->
<!-- (Server parser sees noscript and removes the dangerous code) -->
<!-- But browser parser handles noscript differently and re-parses it: -->
<!-- Result: <img src=x onerror=alert('hacked')> is executed! -->AXSS that mutates user input to make it executable.
BXSS that exploits differences in how browser HTML parsers handle certain inputs.
CXSS that requires multiple mutations to trigger.
DXSS that only affects mutant browsers.
What vulnerability exists in this code?
javascript
// Deserializing untrusted data
const data = JSON.parse(userInput);
// Using it with dangerous operations
Object.assign(config, data);
eval(config.expression);AJSON.parse is always safe.
BPrototype pollution and code injection via eval.
CNo vulnerability; Object.assign is safe.
DOnly vulnerable to CORS attacks.
What is the most secure way to store OAuth2 access tokens in a web application?
javascript
// Bad: localStorage accessible to XSS
localStorage.setItem("accessToken", token); // XSS can steal this!
// Bad: sessionStorage still accessible to XSS
sessionStorage.setItem("accessToken", token);
// Bad: Plain text in database
database.save({ accessToken: "plain-text-token" });AStore in localStorage for easy client-side access.
BStore in sessionStorage for automatic cleanup.
CStore in memory (JavaScript variable) and use HttpOnly cookies for refresh token.
DStore in plain text in the database.
Sign up free to play
Answer all 10 questions (7 more), see explanations for every answer, and track your score.