Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CSCI 4130 - Intro to Cybersecurity > Web Security - Basics, SOP, Sessions > Flashcards

Web Security - Basics, SOP, Sessions Flashcards

(87 cards)

Start Studying
1
Q

Define

Uniform Resource Identifier (URI)

Web Security

A

Identifies a resource (string)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Define

Scheme

Web Security

A

Protocol and framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Components of Uniform Resource Identifier (URI)

Web Security

A
  • Scheme
  • Authority
  • Path
  • Query
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Define

Authority

Web Security

A

Qualifying name (typically DNS host server or IP address)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Define

Path

Web Security

A

Pathname consisting of “/” separated strings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Define

Query

Web Security

A

Application-specific information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Define

Uniform Resource Locator (URL)

Web Security

A

The identifier that contains information on how to locate a existing/available resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define

Uniform Resource Name (URN)

Web Security

A

Identifies an entity regardless of availability/existence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define

Hypertext Markup Language (HTML)

Web Security

A

A language that uses tags and attributes to display a webpage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Define

Javascript

Web Security

A

Powerful script to manipulate client-side data and provides object support

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Why is Javascript suitable for HTML?

A

Javascript is weakly and dynamically typed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Define

HTML Frames

Web Security

A

The tag that allows for multiple separate views/pages associated with separate URLS on the same page

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Directly visiting a page will lead to which frame?

Web Security

A

Main frame

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What does the parent frame do?

Web Security

A

Specify its own style and the placement of the child frame within itself

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Define

Hypertext Transfer Protocol (HTTP)

Web Security

A

An application-layer protocol to transfer information between web client and server (typically port 80)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What does a client do during HTTP?

Web Security

A

Opens a connection and sends requests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does a server do during HTTP?

Web Security

A

Accept client’s connection and sends replies as a response to the requests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

HTTP Request Headers specify

Web Security

A
  • Method
  • Resource
  • Protocol version
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

HTTP Methods

Web Security

A
  • GET()
  • HEAD()
  • POST()
  • PUT()
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Define

HTTP Method: GET()

Web Security

A

Reads data from the URL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Define

HTTP Method: HEAD()

Web Security

A

Fetches information about the data resource from the HTTP header

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Define

HTTP Method: POST()

Web Security

A

Submits “data” and stores data as value in a variable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Define

HTTP Method: PUT()

Web Security

A

Uploads data to a stored variable under a specific resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What specifies a resource?

Web Security

A

An absolute URI or relative path

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
How does an absolute URI request a resource? | Web Security
Through proxy
25
How does a relative path request a resource? | Web Security
Through a server that owns the resource
26
# Define HTTP Response | Web Security
The answer or data read by the server
27
# Define Web Servers | Web Security
Something that loops forever to receive HTTP requests and send HTTP responses
28
Outline a TCP connection | Web Security
1. Client requests to connect with a server 2. Server accepts connection 3. Client sends HTTP Request 4. Server reads and processes HTTP Request 5. Server writes back HTTP Response 6. Connection closed
29
# Define Common Gateway Interface (CGI) | Web Security
Protocol for web servers to execute programs and generate pages dynamically
30
# Define HTML Forms | Web Security
Collects data using GET and POST methods
31
Where is data collected from when an HTML form uses GET()? | Web Security
Query
32
Where is data collected from if an HTML form uses POST()? | Web Security
Body
33
How is data sent back in an HTML form? | Web Security
Name-value pair
34
What happens if data from an HTML form is an empty string? | Web Security
Neither name nor value is present
35
# Define Hypertext Processor (PHP) | Web Security
Executes the page on the server side
36
# Define Clientside Javascript | Web Security
APIs that control web client in an object-oriented way
37
# Define User Agent | Web Security
Client side that retrieves and displays web data
38
# Define Document Object Model (DOM) | Web Security
Documentation that treats an HTML like a tree structure
39
List the parts of a Document Object Model (DOM) | Web Security
* Node * Browser Object Model (BOM)
40
# Define Node in a DOM | Web Security
Part of the document
41
# Define Browser Object Model (BOM) in a DOM | Web Security
The API to browser properties
42
Javascript security is much like | Web Security
Sandbox
43
What is part of Javascript security? | Web Security
* No access to files/network resources or browser history * Windows must be bigger than 100x100 px
44
# Describe Frame Isolation | Web Security
Each site is isolated from one another (exception: if it's the same site)
45
List the types of frame isolation relationships | Web Security
Frame-Frame and Frame-Principal
46
# Describe Frame-Frame | Web Security
* canScript(A, B) - can A execute scripts on B? * canNav(A, B) - can A change B's origin?
47
# Describe Frame-Principal | Web Security
readCookie(F, D) and writeCookie(F, D) - can frame F perform on domain D?
48
# Describe Same Origin Policy (SOP) | Web Security
Isolation of different pages such that a frame in one origin has no access to the resources of a different origin
49
What is an Origin determined by? | Web Security
Determined by string matching and URL of a loaded frame's location
50
What is the tuple for an origin? | Web Security
[Protocol, hostname, port]
51
# Define XMLHTTPRequests (XHR) | Web Security
Allows Javascript to send HTTP Requests to a server and receive data responses from the same origin
52
# Define HTTP Responses under SOP | Web Security
Can interact with other frames from different origins but can't inspect contents on scripts and resources
53
Ways to relax SOP | Web Security
* Set sites from different origins to be from the same domain * Access-Control-Allow-Origin/Cross-Origin resource sharing * Cross-document messaging
54
# Define HTTP Authentication | Web Security
Basic authentication to deny access until credentials are sent during verification procedures
55
Where can Access Control Policy be placed? | Web Security
Directory or global configuration file
56
How can a web application keep track of a state if HTTPs are stateless? | Web Security
* HTTP Cookies * Server side sessions * Embedding information in returned pages (i.e. hidden vars, modified URLS)
57
# Define Session | Web Security
Sequence of HTTP request and responses associated with a user
58
# Define Basic Authentication | Web Security
Form to send creditionals to server-side and an authenticator is returned for validation (i.e. cookie)
59
# Define HTTP Cookie | Web Security
Small data set from and set by site stored in web broser to maintain a state on client side
60
Where can cookies from domain A send its requests to? | Web Security
To domain A
61
What defines the scope of a cookie? | Web Security
Domain and path
62
What if no domain is set for a cookie? | Web Security
Host-only cookie is set (handled by browser)
63
What happens if a path is specified for a cookie? | Web Security
Cookies are used when requesting a page within the path
64
What happens if no path is specified for a cookie? | Web Security
Cookies are used for the path of the requested resource
65
What controls the lifetime of a cookie? | Web Security
Expires and Max-Age
66
# Define Expires | Web Security
When the broswer will delete the cookie
67
What happens if no expiration or max-age is set for a cookie? | Web Security
Cookie becomes a session cookie and will expire when the session is completed
68
# Define Secure Cookie | Web Security
Tells the browser how to use the cookie in secure/encrypted connections
69
# Define HTTP Only Cookie | Web Security
No exposure of the cookie is allowed besides HTTP requests
70
How can a client access a cookie? | Web Security
* Read in scope * Sets a new cookie * Deletes a cookie
71
# SOP: Cookies vs. DOMS abc.com/x ____ receive cookies for abc.com/y | Web Security
Does not receive
72
# SOP: Cookies vs. DOM abc.com/x ____ access the DOM of abc.com/y
Can access
73
# SOP: Cookies vs. DOM Using Javascript, why can abc.com/x see the cookies of abc.com/y? | Web Security
They share the same domain (abc.com)
74
Ways to indirectly bypass SOP | Web Security
* A related domain attacker controls cookies on another domain * Meeting the fixed storage limit of the cookie jar * MITM attacks
75
What can a.abc.com do to b.abc.com? | Web Security
Influence and control b.abc.com's cookies
76
# Define Session Fixation Attack | Web Security
Where a session ID is overwritten and the session is hijacked
77
How does a session fixation attack happen? | Web Security
Attacker gets the ID => victim visits under wrong ID and authenticates => attacker impersonates as victim with the authentication information
78
Defenses against Session Fixations | Web Security
* Update session IDs periodically * Initalize cross-site scripting
79
# Define Cross-Site Request Forgery (CSRF) | Web Security
Malicious Javascript/server code tricking users to perform acts on a different web application
80
Defenses against Cross-Site Request Forgery (CSRF) | Web Security
* Avoid using GET() when exporting functionality * Referer Validation * Secure Token Validation
81
# Describe Referer Validation | Web Security
Header fields that indicates who initated the request
82
Limitation to Referer Validation | Web Security
* Not always available * May leak information
83
If the Referer Validation is none, what are the types of defaults? | Web Security
* Allow: less secure, more usable * Deny: more secure, less usable
84
# Define Secure Token Validation | Web Security
A randomly generated invisible token on the server side for every user's action
85
When is a Secure Token obtained? | Web Security
If the user explicitly visited the right page
86
What are the goals of web security? | Web Security
Protect CIA, privacy, availability, and computing resource

CSCI 4130 - Intro to Cybersecurity (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions