Secure Coding Practices — Series 3

Preview — 3 of 10 questions

Which set of attributes is right for a session cookie?

ASecure; SameSite=None — cross-site requests must keep working.
BHttpOnly; Path=/ — reading it from JavaScript is convenient for the SPA.
CHttpOnly; Secure; SameSite=Lax
DMax-Age=31536000 and nothing else — long sessions are better UX.

Which handler is safe?

javascript
// A
const data = pick(req.body, ['name', 'email']);
await db.user.update({ where: { id: session.userId }, data });

// B
await db.user.update({ where: { id: session.userId }, data: req.body });

// C
const { role, ...rest } = req.body;
await db.user.update({ where: { id: session.userId }, data: rest });
AA
BB
CC
DB and C are both fine, since the where clause is scoped to the session user.

Why use crypto.timingSafeEqual instead of === for an API token?

AIt also normalises Unicode, avoiding false mismatches.
BIt is faster on long strings.
C=== cannot compare Buffer objects at all.
DString comparison stops at the first differing byte, so its duration leaks how much of the prefix was correct; the timing-safe version always compares every byte.

Sign up free to play

Answer all 10 questions (7 more), see explanations for every answer, and track your score.