For Teachers · Back to the Module · Print with your browser's Print command.

P5 Teacher Answer Key: Web Security Headers and Cookies

Teacher Answer Key (about 20 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: F3

Learning Objectives

• [ ] Explain what Content-Security-Policy, X-Frame-Options and X-Content-Type-Options defend against.
• [ ] Explain the Secure, HttpOnly and SameSite cookie flags.

Key Terms

Write each definition in your own words.

• Content Security Policy: An HTTP response header that tells browsers which sources of scripts and other content a page may load.
• Cross-Site Scripting: XSS: injecting script into a web page so it runs in other users' browsers.
• Clickjacking: Tricking a user into clicking something on a hidden, framed copy of another site.
• Cookie Flags: Attributes such as Secure, HttpOnly and SameSite that control when and how a browser sends or exposes a cookie.
• CSRF: Cross-site request forgery: tricking a logged-in user's browser into sending an unwanted request to another site.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only WEB-HDR-,WEB-CK-
2. Open your browser's developer tools on any site you own and compare its response headers with the checks.

Self-Check Questions

1. Which header limits where scripts may load from?

• [ ] a) Referrer-Policy
• [x] b) Content-Security-Policy
• [ ] c) Server
• [ ] d) Strict-Transport-Security
• Answer: b. CSP controls allowed sources for scripts and other resources.

1. The HttpOnly cookie flag:

• [x] a) Hides the cookie from JavaScript
• [ ] b) Encrypts the cookie
• [ ] c) Makes the cookie permanent
• [ ] d) Sends the cookie only over HTTPS
• Answer: a. An XSS bug cannot read an HttpOnly cookie. Sending only over HTTPS is the Secure flag.

1. Clickjacking is prevented by:

• [x] a) frame-ancestors or X-Frame-Options
• [ ] b) HSTS
• [ ] c) Compression
• [ ] d) The SameSite cookie flag
• Answer: a. They stop other sites framing your pages.

1. Which cookie flag keeps a cookie off plain HTTP connections?

• [ ] a) HttpOnly
• [x] b) Secure
• [ ] c) SameSite
• [ ] d) Path
• Answer: b. Secure means the browser sends the cookie only over HTTPS.

1. What does the SameSite cookie flag help reduce?

• [x] a) Cross-site request forgery
• [ ] b) SQL injection
• [ ] c) Clickjacking
• [ ] d) TLS downgrade
• Answer: a. SameSite limits when a cookie is sent with cross-site requests, which reduces CSRF.

1. What does X-Content-Type-Options: nosniff do?

• [x] a) Stops browsers guessing file types
• [ ] b) Blocks all scripts
• [ ] c) Hides the server version
• [ ] d) Turns off caching
• Answer: a. nosniff makes the browser trust the declared content type instead of guessing, so a file cannot be treated as script by mistake.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• OWASP Secure Headers Project: https://owasp.org/projects/secure-headers-project
• OWASP Session Management Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.