Describe the role of Subresource Integrity (SRI) in preventing XSS attacks.
- Encrypts sensitive user information
- Enforces Same-Origin Policy
- Ensures secure transmission of data
- Validates and verifies external scripts
Subresource Integrity (SRI) is a security feature that helps prevent XSS attacks by ensuring the integrity of external scripts, validating and verifying that they haven't been tampered with.
To prevent XSS attacks, it is essential to _________ user input and _________ user output.
- decode
- encode
- sanitize
- validate
To prevent XSS attacks, it is essential to sanitize user input and encode user output. Sanitizing helps remove potentially harmful content, and encoding ensures that user data is displayed correctly and safely in the browser.
_________ is a security standard that prevents the browser from interpreting user input as script.
- CORS
- CSP
- CSRF
- HTTPS
Content Security Policy (CSP) is a security standard that prevents the browser from interpreting user input as a script. It helps mitigate the risk of XSS attacks by defining and enforcing a set of rules for how resources should be loaded on a web page.
When implementing CSP, the _________ directive is crucial in restricting resources the page can load.
- connect-src
- img-src
- script-src
- style-src
When implementing CSP, the connect-src directive is crucial in restricting resources the page can load. It controls which URLs the document is allowed to make requests to, helping prevent unwanted network requests that could pose security risks.
In an XSS attack, the _________ method of XSS involves the attacker injecting a script that is stored on the server.
- DOM-based
- Persistent
- Reflected
- Stored
In a stored XSS attack, the injected script is stored on the server and served to users, making it more dangerous.
_________ encoding is a common technique to prevent XSS by converting special characters into HTML entities.
- Base64
- HTML
- URL
- UTF-8
HTML encoding is a common technique to prevent XSS by converting special characters into HTML entities, making it difficult for attackers to inject malicious scripts.
To mitigate DOM-based XSS attacks, one should avoid using _________ directly with user input.
- document.write()
- getElementById()
- innerHTML
- setAttribute()
Mitigating DOM-based XSS involves avoiding direct use of the innerHTML property with user input, as it can be exploited to execute malicious scripts within the DOM.
A developer is implementing CSP for the first time. What common challenges might they face?
- Blocking Legitimate Scripts
- Compatibility Issues with Older Browsers
- Difficulty in Debugging
- Increased Load Times
Implementing Content Security Policy (CSP) for the first time may face compatibility issues with older browsers. These issues could arise due to the introduction of security restrictions that are not supported in older browser versions.
Initialization parameters for a servlet are configured in the _________ file.
- config.xml
- initparams.xml
- servlet.xml
- web.xml
Initialization parameters for a servlet are configured in the web.xml file.
What mechanism does WebSocket use to achieve full-duplex communication?
- Long Polling
- Polling
- Request-Response
- WebSocket uses its own protocol
WebSocket achieves full-duplex communication by using its own protocol, which enables bidirectional communication between the client and the server in real-time without the need for constant polling.