All quizzesMedium
Secure Coding Practices — Series 3
Preview — 3 of 10 questions
Which set of attributes is right for a session cookie?
ASecure; SameSite=None — cross-site requests must keep working.
BHttpOnly; Path=/ — reading it from JavaScript is convenient for the SPA.
CHttpOnly; Secure; SameSite=Lax
DMax-Age=31536000 and nothing else — long sessions are better UX.
Which handler is safe?
javascript
// A
const data = pick(req.body, ['name', 'email']);
await db.user.update({ where: { id: session.userId }, data });
// B
await db.user.update({ where: { id: session.userId }, data: req.body });
// C
const { role, ...rest } = req.body;
await db.user.update({ where: { id: session.userId }, data: rest });AA
BB
CC
DB and C are both fine, since the where clause is scoped to the session user.
Why use crypto.timingSafeEqual instead of === for an API token?
AIt also normalises Unicode, avoiding false mismatches.
BIt is faster on long strings.
C=== cannot compare Buffer objects at all.
DString comparison stops at the first differing byte, so its duration leaks how much of the prefix was correct; the timing-safe version always compares every byte.
Sign up free to play
Answer all 10 questions (7 more), see explanations for every answer, and track your score.