For Teachers · Back to the Module · Print with your browser's Print command.

P5 Worksheet: Web Security Headers and Cookies

Student Worksheet (about 20 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: F3

Learning Objectives

• [ ] Explain what Content-Security-Policy, X-Frame-Options and X-Content-Type-Options defend against.
• [ ] Explain the Secure, HttpOnly and SameSite cookie flags.

Key Terms

Write each definition in your own words.

• Content Security Policy: ______________________________________________
• Cross-Site Scripting: ______________________________________________
• Clickjacking: ______________________________________________
• Cookie Flags: ______________________________________________
• CSRF: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only WEB-HDR-,WEB-CK-
2. Open your browser's developer tools on any site you own and compare its response headers with the checks.

Self-Check Questions

1. Which header limits where scripts may load from?

• [ ] a) Referrer-Policy
• [ ] b) Content-Security-Policy
• [ ] c) Server
• [ ] d) Strict-Transport-Security

1. The HttpOnly cookie flag:

• [ ] a) Hides the cookie from JavaScript
• [ ] b) Encrypts the cookie
• [ ] c) Makes the cookie permanent
• [ ] d) Sends the cookie only over HTTPS

1. Clickjacking is prevented by:

• [ ] a) frame-ancestors or X-Frame-Options
• [ ] b) HSTS
• [ ] c) Compression
• [ ] d) The SameSite cookie flag

1. Which cookie flag keeps a cookie off plain HTTP connections?

• [ ] a) HttpOnly
• [ ] b) Secure
• [ ] c) SameSite
• [ ] d) Path

1. What does the SameSite cookie flag help reduce?

• [ ] a) Cross-site request forgery
• [ ] b) SQL injection
• [ ] c) Clickjacking
• [ ] d) TLS downgrade

1. What does X-Content-Type-Options: nosniff do?

• [ ] a) Stops browsers guessing file types
• [ ] b) Blocks all scripts
• [ ] c) Hides the server version
• [ ] d) Turns off caching

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• OWASP Secure Headers Project: https://owasp.org/projects/secure-headers-project
• OWASP Session Management Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.