Security Architecture — Series 3

Preview — 3 of 10 questions

An app embeds a third-party widget and exchanges messages with it. Which handler is sound?

javascript

// A
window.addEventListener('message', (e) => apply(e.data));

// B
window.addEventListener('message', (e) => {
  if (e.origin.includes('widget.example.com')) apply(e.data);
});

// C
window.addEventListener('message', (e) => {
  if (e.origin !== 'https://widget.example.com') return;
  if (e.source !== iframe.contentWindow) return;
  apply(schema.parse(e.data));
});

AA — the browser already restricts message events to the frames you embed.

DB, plus sending with targetOrigin: '*' to avoid origin-mismatch errors.

JWT access tokens are stateless, so how do you handle a user pressing log out everywhere?

AKeep access tokens short-lived (minutes) with a long-lived, stored refresh token; revocation deletes the refresh record, and the access token expires on its own shortly after.

BDelete the token from localStorage — that is what logging out means.

CRotate the signing secret, invalidating everyone's tokens.

DAdd the token to a deny-list checked on every request.

What does script-src 'nonce-r4nd0m' 'strict-dynamic' change?

AIt blocks all scripts except those loaded from the same origin.

BIt allows any script whose URL appears in an allow-list, ignoring the nonce.

CIt disables CSP for scripts, leaving only the other directives active.

DScripts carrying the nonce may execute and may load further scripts programmatically, which inherit trust; host allow-lists and 'unsafe-inline' are ignored, so an injected <script> without the nonce cannot run.

Answer all 10 questions (7 more), see explanations for every answer, and track your score.