A web application uses user input in its search functionality without proper sanitization. Identify the type of XSS vulnerability.
- Blind XSS
- DOM-based XSS
- Reflected XSS
- Stored XSS
In a scenario where user input is stored without proper sanitization, it can lead to Stored XSS vulnerability. This occurs when the malicious script is permanently stored on the target server and served to users who access the affected page.
In a scenario where a user's session cookies are stolen via XSS, what security measures could have prevented this?
- Cross-Site Request Forgery (CSRF) Token
- Data Encryption
- HttpOnly Cookies
- Multi-Factor Authentication (MFA)
The use of HttpOnly Cookies, which cannot be accessed by JavaScript, is a security measure that could have prevented the theft of session cookies via XSS. By restricting access, the impact of XSS attacks on session data can be mitigated.
What is the primary purpose of using WebSockets in web applications?
- Batch processing
- File storage
- Real-time communication
- Static content delivery
The primary purpose of WebSockets in web applications is to enable real-time communication between the client and server, allowing for interactive and dynamic updates without the need for constant polling.
Which Java API is used for creating WebSocket applications in Java EE?
- java.socket
- java.web
- javax.communication
- javax.websocket
The javax.websocket API is used for creating WebSocket applications in Java EE, providing classes and interfaces to work with the WebSocket protocol.
In the context of servlets, what is a key difference between HTTP and WebSocket protocols?
- Connectionless protocol
- Full-duplex communication
- Request-Response model
- Stateless communication
A key difference between HTTP and WebSocket protocols is that WebSocket enables full-duplex communication, allowing both the client and server to send messages independently in real-time.
How does the WebSocket protocol handle message framing compared to HTTP?
- Messages are framed using JSON format.
- Messages are framed using XML format.
- Messages are framed using headers and payload.
- Messages are not framed; they are sent as a continuous stream.
The WebSocket protocol handles message framing by using headers and payload, unlike HTTP, where messages are not framed, and they are sent as a continuous stream.
How can a servlet-based application detect and handle WebSocket upgrade requests?
- By inspecting the payload
- Using the Connection header
- Using the Upgrade header
- WebSockets cannot be used with servlets
A servlet-based application can detect and handle WebSocket upgrade requests by inspecting the Upgrade header in the HTTP request, indicating the intention to switch protocols to WebSocket.
Describe the lifecycle of a WebSocket in a Java web application.
- Connect, Communicate, Disconnect
- Create, Transmit, Terminate
- Handshake, Data Transfer, Termination
- Initialization, Open, Close
The lifecycle of a WebSocket in a Java web application involves a handshake phase, followed by data transfer, and finally, termination. This sequence includes establishing the connection, exchanging data, and closing the connection.
A WebSocket connection is established with a _________ handshake upgraded from an HTTP connection.
- SSL/TLS
- TCP
- UDP
- WebSocket
A WebSocket connection is established with a "WebSocket" handshake upgraded from an HTTP connection.
In Java EE, the _________ method is used to send a message to the connected WebSocket client.
- broadcastMessage()
- sendMessage()
- sendText()
- writeMessage()
In Java EE, the sendMessage() method is used to send a message to the connected WebSocket client.