All quizzesMedium
API Security Patterns — Series 3
Preview — 3 of 10 questions
An authenticated user changes /invoices/123 to /invoices/124 and receives another customer's invoice. Which check is missing?
AVerification that the session token is well formed.
BUnpredictable invoice IDs with sufficient random entropy.
CValidation that the invoice ID is an integer.
DAuthorization for the specific requested invoice.
A backend fetches a user-supplied URL after checking that its host resolves to a public IP. The HTTP client follows redirects automatically. What further control is needed?
AResolve and validate the original hostname twice before starting.
BTrust the redirect if the original host has a valid certificate.
CAccept redirects whenever they preserve the HTTPS scheme.
DValidate every destination hop and restrict outbound access.
A provider signs the exact raw request body. A handler parses JSON and serializes it again before verifying the signature. Legitimate requests fail verification. Why?
AThe verifier must decompress and prettify every signed payload first.
BSerialization can change the bytes covered by the signature.
CA different JSON key order means the provider used another signing key.
DThe verifier should sort JSON keys to match the logical object.
Sign up free to play
Answer all 10 questions (7 more), see explanations for every answer, and track your score.