For cookie or session poisoning, which practice is recommended?

For cookie or session poisoning, which practice is recommended?

• A. Do not store plain text or weakly encrypted passwords.
• B. Implement cookie's timeout.
• C. Set the secure flag on all sensitive cookies.
• D. Strongly validate user input.

Answer: (B)

Managing the lifetime of a session cookie is a key defense against cookie or session poisoning. Implementing a timeout on cookies sets an expiration so a stolen or forged cookie becomes unusable after a short period. This tightens the window an attacker has to exploit a compromised session and forces reauthentication, which helps prevent ongoing hijacking or misuse of the session. Other choices touch on related security practices but don’t directly address the poisoning risk as effectively. Not storing plain text or weak passwords protects credentials, not the cookie itself. Setting the secure flag helps protect cookies in transit, but if a cookie has already been captured, the flag doesn’t limit how long it can be used. Strong input validation is important for overall security, but it doesn’t specifically mitigate session cookie poisoning.

Managing the lifetime of a session cookie is a key defense against cookie or session poisoning. Implementing a timeout on cookies sets an expiration so a stolen or forged cookie becomes unusable after a short period. This tightens the window an attacker has to exploit a compromised session and forces reauthentication, which helps prevent ongoing hijacking or misuse of the session.

Other choices touch on related security practices but don’t directly address the poisoning risk as effectively. Not storing plain text or weak passwords protects credentials, not the cookie itself. Setting the secure flag helps protect cookies in transit, but if a cookie has already been captured, the flag doesn’t limit how long it can be used. Strong input validation is important for overall security, but it doesn’t specifically mitigate session cookie poisoning.