I85PREP
⌘ K
HTB CWEE study materials
HTB CWEE study resources

HTB CWEE practice questions

One question at a time. Build your HTB CWEE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Web Application Reconnaissance and Enumeration

During web application reconnaissance, which HTTP response header most directly reveals the server-side framework or runtime in use?

  1. X-Powered-By Correct answer.
  2. Cache-Control
  3. Accept-Ranges
  4. Content-Length

Explanation

X-Powered-By is frequently emitted by runtimes such as PHP, ASP.NET, or Express and names the technology directly. Content-Length, Accept-Ranges, and Cache-Control describe message framing or caching behavior and do not identify the stack.

Question 2Web Application Reconnaissance and Enumeration

A tester wants to enumerate directories on a target without triggering a flood of 404 responses. Which ffuf configuration best supports this?

  1. Setting -mc all and ignoring the output
  2. Disabling the wordlist and using -X POST
  3. Increasing the thread count to maximum
  4. Filtering out responses with status 404 using -fc 404 Correct answer.

Explanation

The -fc flag filters responses by status code, letting the tester suppress the baseline 404 noise so only meaningful hits surface. Raising threads or accepting every status code increases noise rather than reducing it.

Question 3Web Application Reconnaissance and Enumeration

Which artifact in a JavaScript bundle most reliably points to hidden API endpoints used by a single-page application?

  1. Source map comment referencing a CDN
  2. String literals containing path segments such as /api/v1/ Correct answer.
  3. CSS class name hashes
  4. Meta viewport tag

Explanation

Client-side code must reference the URLs it calls, so path fragments like /api/v1/ inside string literals often reveal endpoints absent from visible UI. CSS hashes and viewport metadata carry no routing information.

Question 4Web Application Reconnaissance and Enumeration

What is the primary purpose of inspecting a site's robots.txt during reconnaissance?

  1. It may disclose paths the owner intended to keep out of crawlers Correct answer.
  2. It defines the server's allowed HTTP verbs
  3. It lists valid credentials for administrative panels
  4. It contains the TLS certificate chain

Explanation

robots.txt is a crawler directive, and administrators sometimes list sensitive directories there, inadvertently advertising them. It never contains credentials, certificate data, or verb allowlists.

Question 5Web Application Reconnaissance and Enumeration

An analyst observes that requesting a non-existent path returns HTTP 200 with a generic HTML page. Which technique best distinguishes real directories from this soft-404 behavior?

  1. Switch from GET to HEAD
  2. Rely solely on the status code
  3. Append a trailing slash to every request
  4. Compare response body length and content against a known random path Correct answer.

Explanation

Soft-404s return 200 for missing resources, so the status code alone is unreliable. Requesting a random nonexistent path establishes a baseline body size and content signature that real hits can be compared against.

Question 6Web Application Reconnaissance and Enumeration

Which tool is designed specifically for subdomain enumeration by querying passive sources such as certificate transparency logs?

  1. amass Correct answer.
  2. sqlmap
  3. hydra
  4. nikto

Explanation

amass aggregates passive and active sources, including certificate transparency logs, to enumerate subdomains. The other tools target SQL injection, credential brute forcing, and web server scanning respectively.

Question 7Web Application Reconnaissance and Enumeration

A target returns the header Server: nginx/1.18.0. What is the most defensible reconnaissance conclusion?

  1. The host is definitely vulnerable to RCE
  2. The server likely runs nginx 1.18.0 and warrants checking for version-specific issues Correct answer.
  3. The application is written in Python
  4. The site uses a Windows IIS stack

Explanation

The Server header reports the software and version, which is useful for correlating known issues, but it does not prove exploitability. It says nothing about application language and contradicts an IIS assumption.

Question 8Web Application Reconnaissance and Enumeration

When reviewing a JavaScript file, a tester finds the string 'debug: true' guarded by a query parameter check. What is the most useful next step?

  1. Delete the parameter from the URL
  2. Assume the string is dead code and ignore it
  3. Request the page with that parameter set and observe any debugging output Correct answer.
  4. Report it as a confirmed vulnerability immediately

Explanation

Client-side flags often activate verbose behavior when the matching parameter is present, so exercising the parameter can reveal stack traces, internal paths, or extra endpoints. Confirming behavior precedes any vulnerability report.

Question 9Web Application Reconnaissance and Enumeration

Which DNS record type commonly reveals third-party services and verification tokens that map to a target's infrastructure?

  1. PTR
  2. SOA
  3. NS
  4. TXT Correct answer.

Explanation

TXT records frequently hold SPF, DKIM, domain-verification, and service tokens that identify SaaS providers and mail infrastructure. NS and SOA describe authoritative servers, and PTR handles reverse lookups.

Question 10Web Application Reconnaissance and Enumeration

A tester discovers /.git/HEAD returns 200. What does this most strongly suggest?

  1. The repository metadata is exposed and source code may be recoverable Correct answer.
  2. The path is a soft-404
  3. The server is running Git over HTTP intentionally
  4. The site uses Git for CI/CD but nothing is exposed

Explanation

A 200 on /.git/HEAD indicates the VCS directory is web-accessible, allowing reconstruction of source and history. This is an exposure finding, not evidence of a legitimate Git-over-HTTP service.

Question 11Web Application Reconnaissance and Enumeration

Which technique best reveals virtual hosts hosted on the same IP address as the target?

  1. Sending requests with varying Host headers and comparing responses Correct answer.
  2. Scanning UDP ports 137 and 138
  3. Querying the WHOIS registrar record
  4. Performing a zone transfer against the target's NS

Explanation

Virtual host discovery relies on varying the Host header while keeping the IP constant and comparing response size, status, and content. Zone transfers, UDP scans, and WHOIS do not enumerate vhosts on a single address.

Question 12Web Application Reconnaissance and Enumeration

What does the presence of a .well-known/security.txt file primarily provide to a reconnaissance tester?

  1. A copy of the TLS private key
  2. A list of valid user accounts
  3. The application's database schema
  4. Contact and disclosure policy information for reporting issues Correct answer.

Explanation

security.txt is a standardized file describing how to contact the organization about vulnerabilities and its disclosure policy. It does not contain accounts, schemas, or key material.

Question 13Web Application Reconnaissance and Enumeration

An analyst wants to detect parameter names accepted by an endpoint that are not present in the visible form. Which approach is most direct?

  1. Run a full TCP port scan
  2. Brute force the login form
  3. Fuzz parameter names and compare response differences Correct answer.
  4. Check the WHOIS record

Explanation

Hidden parameters are found by supplying candidate names and observing changes in response length, status, or content. Login brute forcing, port scanning, and WHOIS do not enumerate accepted parameters.

Question 14Web Application Reconnaissance and Enumeration

Which source most reliably maps a target's historical hostnames and related infrastructure over time?

  1. The current index.html
  2. A single nmap SYN scan
  3. Passive DNS datasets Correct answer.
  4. The HTTP Date header

Explanation

Passive DNS aggregates historical resolution data, exposing hostnames and IP relationships that current scans miss. A static page, one scan, or a date header cannot provide historical mapping.

Question 15Web Application Reconnaissance and Enumeration

During enumeration, a tester finds an /admin path returning 302 to /login. What is the most reasonable interpretation?

  1. The path does not exist
  2. The server is down
  3. The redirect proves the admin panel is unauthenticated
  4. The path exists but requires authentication, so it is worth further testing Correct answer.

Explanation

A redirect to a login page indicates the route exists and is protected, making it a target for authentication testing. A missing path would typically yield 404 or a soft-404 page.

Question 16Web Application Reconnaissance and Enumeration

Which HTTP method enumeration approach reveals server-supported verbs most efficiently?

  1. Querying robots.txt
  2. Sending an OPTIONS request and reading the Allow header Correct answer.
  3. Using the TRACE method exclusively
  4. Requesting only GET repeatedly

Explanation

OPTIONS commonly returns an Allow header listing supported methods in a single request. Repeated GETs, TRACE alone, or robots.txt do not enumerate verbs.

Question 17Web Application Reconnaissance and Enumeration

A tester notices that adding a trailing dot to the Host header changes the response to a different application. What does this indicate?

  1. The application uses HTTP/2
  2. The server is running on a non-standard port
  3. The DNS zone is misconfigured
  4. The vhost routing is sensitive to hostname normalization quirks Correct answer.

Explanation

Different responses for a trailing-dot hostname suggest routing logic that normalizes hostnames inconsistently, which can bypass access controls. It does not imply port, protocol, or DNS zone issues.

Question 18Web Application Reconnaissance and Enumeration

Which file commonly leaks framework version and environment details when exposed in a Laravel application?

  1. sitemap.xml
  2. crossdomain.xml
  3. humans.txt
  4. .env Correct answer.

Explanation

The .env file holds environment variables such as database credentials, app keys, and version settings. Sitemap, humans.txt, and crossdomain.xml serve unrelated purposes and rarely contain secrets.

Question 19Web Application Reconnaissance and Enumeration

An analyst wants to identify technologies behind a site without sending intrusive payloads. Which approach fits best?

  1. Brute forcing the admin password
  2. Running an exploit framework against the login page
  3. Reviewing response headers, cookies, and HTML patterns against known signatures Correct answer.
  4. Performing a denial-of-service test

Explanation

Passive fingerprinting correlates headers, cookie names, and markup patterns with known technology signatures without exploitation. Exploit attempts, brute forcing, and DoS testing are intrusive and out of scope for passive recon.

Question 20Web Application Reconnaissance and Enumeration

What is the primary value of a source map (.map) file found next to a bundled JavaScript file?

  1. It can reconstruct original source files and reveal internal logic Correct answer.
  2. It lists the server's open ports
  3. It stores user session tokens
  4. It encrypts the JavaScript bundle

Explanation

Source maps map minified code back to original sources, exposing readable logic, comments, and endpoint references. They do not encrypt bundles, list ports, or hold session tokens.

Question 21Web Application Reconnaissance and Enumeration

Which response characteristic most reliably distinguishes a wildcard DNS entry during subdomain enumeration?

  1. Random subdomains resolve to the same IP or content Correct answer.
  2. The NS record changes per query
  3. The SOA serial increments
  4. The TTL is always zero

Explanation

Wildcard DNS causes arbitrary random labels to resolve, often to identical addresses or pages, which must be filtered to avoid false positives. TTL, NS changes, and SOA serials do not indicate wildcards.

Question 22Web Application Reconnaissance and Enumeration

A tester finds that /api/users returns JSON listing users without authentication. Which reconnaissance observation is most significant?

  1. The endpoint uses JSON, so it is safe
  2. The endpoint is a static file
  3. The endpoint requires a CSRF token
  4. An unauthenticated endpoint exposes object data and likely supports further ID enumeration Correct answer.

Explanation

An unauthenticated data endpoint indicates broken access control and a path for enumerating further objects via identifiers. The response format itself does not imply safety.

Question 23Web Application Reconnaissance and Enumeration

Which approach best enumerates API versions that may expose weaker controls?

  1. Scanning UDP ports
  2. Reading the robots.txt only
  3. Requesting versioned paths such as /v1/ and /v2/ and comparing behavior Correct answer.
  4. Only testing the documented current version

Explanation

Older API versions often remain deployed with weaker authentication or validation, so comparing versioned paths can reveal differences. Testing only the current version, UDP scanning, or robots.txt misses this.

Question 24Web Application Reconnaissance and Enumeration

During recon, an analyst finds an open directory listing at /backup/. What is the most useful immediate action?

  1. Ignore it because listings are harmless
  2. Enumerate the listed files for archives, configuration, or source code Correct answer.
  3. Immediately run a password brute force
  4. Change the Host header to localhost

Explanation

An open listing exposes file names that may include backups, configs, or source archives, which should be catalogued and reviewed. Dismissing it or jumping to brute forcing skips the valuable information.

Question 25Authentication and Authorization Flaws (broken access control, IDOR, session handling)

A web application stores the authenticated user's role in a client-side cookie that is Base64-encoded but not signed. Which access control weakness does this most directly enable?

  1. Credential stuffing against the login endpoint
  2. Session fixation through cookie pre-setting
  3. Privilege escalation by tampering with the decoded role value Correct answer.
  4. Cross-site request forgery via automatic cookie attachment

Explanation

When authorization data lives in a client-controlled cookie without integrity protection, the user can decode, edit, and re-encode the value to claim a higher role. The server must derive the role from server-side state or verify a signature before trusting it.

Question 26Authentication and Authorization Flaws (broken access control, IDOR, session handling)

An API endpoint returns a user's invoice when called as GET /api/invoices?id=1042. The only check performed is that the caller is authenticated. Which vulnerability class does this represent?

  1. Server-side request forgery
  2. Open redirect
  3. Insecure direct object reference Correct answer.
  4. XML external entity injection

Explanation

The endpoint exposes an object by a predictable identifier and verifies only authentication, not that the caller owns invoice 1042. That is the defining pattern of an insecure direct object reference.

Question 27Authentication and Authorization Flaws (broken access control, IDOR, session handling)

Which session management practice best mitigates session fixation?

  1. Rotating the session identifier upon successful authentication Correct answer.
  2. Storing the session identifier in localStorage instead of a cookie
  3. Disabling the Secure flag so the cookie works over HTTP
  4. Increasing the session cookie lifetime to reduce re-login friction

Explanation

Session fixation works because the attacker knows a pre-authentication identifier that remains valid after login. Issuing a fresh identifier at authentication invalidates the attacker's planted value.

Question 28Authentication and Authorization Flaws (broken access control, IDOR, session handling)

A site enforces role checks only in the JavaScript front end, hiding admin buttons from non-admin users. What is the primary risk?

  1. TLS certificate validation will fail for admin users
  2. The application becomes vulnerable to reflected cross-site scripting
  3. Users can call the admin API endpoints directly and bypass the hidden UI Correct answer.
  4. The session cookie will be rejected by the browser

Explanation

Client-side controls are cosmetic; anyone can craft requests to the underlying endpoints. Authorization must be enforced server-side on every sensitive request regardless of what the UI displays.

Question 29Authentication and Authorization Flaws (broken access control, IDOR, session handling)

What distinguishes horizontal privilege escalation from vertical privilege escalation?

  1. Horizontal targets servers; vertical targets clients
  2. Horizontal requires network access; vertical requires local access
  3. Horizontal accesses another user's resources at the same privilege level; vertical gains higher privileges Correct answer.
  4. Horizontal relies on CSRF; vertical relies on XSS

Explanation

Horizontal escalation crosses a user boundary while staying at the same role, such as reading another customer's data. Vertical escalation moves to a more privileged role such as administrator.

Question 30Authentication and Authorization Flaws (broken access control, IDOR, session handling)

A session cookie is set without the HttpOnly attribute. Which consequence is most relevant to session handling?

  1. The cookie is sent over unencrypted HTTP connections
  2. Client-side script can read the cookie value if an XSS flaw exists Correct answer.
  3. The cookie cannot be deleted by the user
  4. The cookie is shared across unrelated domains

Explanation

HttpOnly prevents JavaScript from reading the cookie via document.cookie. Without it, an XSS flaw becomes a direct path to session theft.

Question 31Authentication and Authorization Flaws (broken access control, IDOR, session handling)

Which control most directly prevents an attacker from replaying a stolen session token after the legitimate user logs out?

  1. Setting the SameSite attribute to Lax
  2. Server-side invalidation of the session on logout Correct answer.
  3. Encoding the session token in Base64
  4. Adding a longer expiry to the cookie

Explanation

Logout must destroy the server-side session record so the token no longer authenticates anyone. Relying on client-side cookie deletion alone leaves the token valid on the server.

Question 32Authentication and Authorization Flaws (broken access control, IDOR, session handling)

An application accepts a JWT and trusts the alg header without validation. An attacker changes alg to none and strips the signature. What is the root cause?

  1. The token lifetime is too short
  2. The token is transmitted over TLS
  3. The token uses too few claims for authorization
  4. The server fails to enforce an expected signing algorithm and verify the signature Correct answer.

Explanation

Accepting attacker-chosen algorithm values, including none, lets unsigned tokens pass. The verifier must pin an allowed algorithm and always check the signature against a trusted key.

Question 33Authentication and Authorization Flaws (broken access control, IDOR, session handling)

A developer wants to prevent IDOR in a REST API that returns documents by numeric ID. Which approach is most robust?

  1. Obfuscate the ID parameter name in the front-end code
  2. Rely on unguessable sequential IDs so attackers cannot enumerate documents
  3. Require a CAPTCHA before each document request
  4. Check on the server that the authenticated principal is authorized for the requested document Correct answer.

Explanation

The durable fix is a server-side authorization check tying the object to the requesting principal. Obscurity and unpredictable identifiers only raise the effort, they do not enforce ownership.

Question 34Authentication and Authorization Flaws (broken access control, IDOR, session handling)

A password reset flow accepts a token parameter and looks up the account by the email parameter in the same request. What flaw does this introduce?

  1. The flow enables session fixation
  2. The reset link becomes vulnerable to open redirect
  3. The reset token can be applied to a different account than the one it was issued for Correct answer.
  4. The token is exposed to SQL injection

Explanation

If the account is chosen from a request parameter rather than bound to the token, an attacker can pair their valid token with a victim's email. The token must be tied server-side to the specific account.

Question 35Authentication and Authorization Flaws (broken access control, IDOR, session handling)

An application uses a UUID as the only protection on a file download endpoint, and UUIDs appear in a public activity feed. Which statement is accurate?

  1. The endpoint is still vulnerable because authorization is not checked Correct answer.
  2. The endpoint is safe because UUIDs are cryptographically random
  3. The endpoint is safe because UUIDs are longer than integers
  4. The endpoint is vulnerable only if TLS is disabled

Explanation

Unpredictable identifiers are not an authorization mechanism; once an identifier is disclosed, anyone can request it. Ownership must be verified server-side on each access.

Question 36Authentication and Authorization Flaws (broken access control, IDOR, session handling)

A web app sets the session cookie with SameSite=None but without the Secure attribute. What is the practical outcome in modern browsers?

  1. The cookie is scoped to a single path automatically
  2. The cookie is rejected because SameSite=None requires Secure Correct answer.
  3. The cookie becomes immune to CSRF
  4. The cookie is silently upgraded to SameSite=Strict

Explanation

Browsers enforce that SameSite=None cookies must also carry Secure, otherwise the cookie is refused. This prevents cross-site cookies from being sent over insecure channels.

Question 37Authentication and Authorization Flaws (broken access control, IDOR, session handling)

A role check reads the X-Forwarded-For header to decide whether a request is internal and therefore trusted. Why is this dangerous?

  1. The header is encrypted and cannot be parsed by the server
  2. The header is only set by browsers during CSRF
  3. The header disables TLS for the request
  4. The header is client-controllable, so an attacker can spoof an internal address Correct answer.

Explanation

Clients can send arbitrary X-Forwarded-For values unless a trusted proxy overwrites them. Trusting it for authorization lets an attacker impersonate an internal source.

Question 38Authentication and Authorization Flaws (broken access control, IDOR, session handling)

An application issues a session cookie but never regenerates it and never expires it server-side. Which two weaknesses are present?

  1. Open redirect and directory traversal
  2. Session fixation exposure and indefinite replay of stolen tokens Correct answer.
  3. Weak TLS ciphers and missing HSTS
  4. SQL injection and cross-site scripting

Explanation

Not rotating on login leaves a planted identifier valid, and no server-side expiry means a captured token works forever. Both are core session lifecycle failures.

Question 39Authentication and Authorization Flaws (broken access control, IDOR, session handling)

An API authorizes requests by checking that the JWT signature is valid but never checks the aud claim. A token issued for a different service is accepted. What is the flaw?

  1. The token is stored in localStorage
  2. The signature algorithm is too weak
  3. The token lacks an expiration claim
  4. Missing audience validation allows token reuse across services Correct answer.

Explanation

The aud claim binds a token to its intended recipient. Without checking it, a token minted for another service in the same trust domain can be replayed here.

Question 40Authentication and Authorization Flaws (broken access control, IDOR, session handling)

A site uses a hidden form field named isAdmin with value false and trusts it on submission. Which remediation is correct?

  1. Rename the field to a less obvious name
  2. Add a client-side check before submission
  3. Remove the field and derive the role from the server-side session Correct answer.
  4. Encrypt the hidden field value with a static key

Explanation

Any value submitted by the client is untrusted, so authorization must come from server-side state. Encrypting or renaming a client field still leaves the decision client-influenced.

Question 41Authentication and Authorization Flaws (broken access control, IDOR, session handling)

A multi-tenant SaaS app filters records by tenant_id taken from a query parameter rather than the authenticated session. What is the most likely impact?

  1. Weak password hashing
  2. Denial of service through resource exhaustion
  3. Reflected XSS in the tenant dashboard
  4. Cross-tenant data disclosure by changing the tenant_id value Correct answer.

Explanation

When tenancy is selected by a client parameter, a user can request another tenant's records. Tenant scope must be derived from the authenticated identity, not from request input.

Question 42Authentication and Authorization Flaws (broken access control, IDOR, session handling)

Which scenario best illustrates a forced browsing attack against broken access control?

  1. Injecting a script into a comment field
  2. Intercepting traffic on an open Wi-Fi network
  3. Requesting /admin/export directly as a low-privileged user without any UI link Correct answer.
  4. Submitting a login form with a guessed password

Explanation

Forced browsing means requesting resources that are not linked in the UI, hoping the server omits authorization. It succeeds only when the endpoint fails to enforce access control.

Question 43Authentication and Authorization Flaws (broken access control, IDOR, session handling)

An app stores permissions in a cookie signed with a key that is also used for password reset tokens. Which issue is most significant?

  1. The cookie will not be sent with cross-site requests
  2. Password reset tokens become shorter
  3. The signature makes the cookie immune to tampering
  4. Key reuse broadens the impact of any single key compromise Correct answer.

Explanation

Reusing one secret across distinct security functions means one leak undermines all of them. Keys should be separated per purpose to limit blast radius.

Question 44Authentication and Authorization Flaws (broken access control, IDOR, session handling)

An application checks authorization using the HTTP method, trusting GET as read-only and POST as privileged. Why is this insufficient?

  1. HTTP methods are case-sensitive in routing
  2. POST requests are always encrypted
  3. GET requests cannot carry cookies
  4. Method semantics can be misused and state changes may occur on GET Correct answer.

Explanation

Servers may perform state changes on GET, and clients can send any method. Authorization must be based on the action and resource, not on assumed method semantics.

Question 45Authentication and Authorization Flaws (broken access control, IDOR, session handling)

A site validates the redirect target only by checking that it starts with the string https://trusted.example. An attacker supplies https://trusted.example.evil.com. What occurs?

  1. The browser resolves the URL to trusted.example
  2. The check passes and the user is redirected to the attacker's domain Correct answer.
  3. The request fails TLS validation
  4. The redirect is blocked because the host differs

Explanation

A prefix check matches attacker.example.evil.com because the trusted string is only a prefix, not the full host. Validation must parse the URL and compare the host exactly.

Question 46Authentication and Authorization Flaws (broken access control, IDOR, session handling)

An attacker obtains a victim's session cookie value through a network capture. Which combination of attributes would have most limited this exposure?

  1. No attributes with a random cookie name
  2. Path=/admin with Domain set broadly
  3. Secure and HttpOnly with a short server-side expiry Correct answer.
  4. SameSite=Lax with a long expiry

Explanation

Secure keeps the cookie off plaintext channels, HttpOnly blocks script access, and short server-side expiry limits replay. Together they reduce both capture and misuse windows.

Question 47Authentication and Authorization Flaws (broken access control, IDOR, session handling)

An application accepts a session token in a URL query string. What is the primary security concern?

  1. The token cannot be tied to a user
  2. Tokens leak through logs, referrer headers, and browser history Correct answer.
  3. The token cannot be validated server-side
  4. The token bypasses TLS encryption

Explanation

URLs are recorded in many places, including proxy logs and Referer headers, so tokens in query strings are widely exposed. Session identifiers belong in cookies with appropriate attributes.

Question 48Authentication and Authorization Flaws (broken access control, IDOR, session handling)

A GraphQL API authorizes the top-level query but resolves nested fields that fetch other users' records. Which control is missing?

  1. Per-field authorization on each resolver Correct answer.
  2. Persisted queries only
  3. Disabling introspection
  4. Query depth limiting

Explanation

Authorization must be enforced at each resolver that returns sensitive data, not only at the entry point. Nested resolvers otherwise expose objects that bypass the top-level check.

Question 49Authentication and Authorization Flaws (broken access control, IDOR, session handling)

A server validates JWT signatures using a public key supplied in the token header (jku). Why is this dangerous?

  1. An attacker can point jku to their own key and sign a forged token Correct answer.
  2. The token becomes too large to parse
  3. The jku claim disables expiration checks
  4. The public key cannot verify signatures

Explanation

Trusting a key URL from the token lets an attacker host their own keypair and produce a token that verifies. The verifier must use a fixed, trusted key set rather than header-supplied locations.

Question 50Authentication and Authorization Flaws (broken access control, IDOR, session handling)

An application stores a user's role inside a self-contained token that the client sends back on each request, and the server reads the role from that token without consulting its own records. Which design change most directly closes the privilege-escalation risk this creates?

  1. Increase the token's length so the role field cannot be guessed by an attacker
  2. Compress the token payload so the role claim is no longer human-readable
  3. Rotate the token signing key on a fixed weekly schedule
  4. Resolve the role from server-side state keyed to the authenticated identity on every request Correct answer.

Explanation

Authorization decisions must be derived from data the server controls and can revoke, not from values the client can present. If the role travels in a client-held token, the server must still look up the authoritative role from its own store using the authenticated identity. Signing and key rotation protect integrity and freshness but do not stop a legitimately issued token from carrying a stale or inflated role.