cookies
AI security interview questions tagged cookies, across every topic.
2 questions · 1 unlocked for you
Concepts behind "cookies"
Explanations of the mechanisms these questions rely on.
Foundational
Sessions, Cookies and TokensA session links later requests to authenticated state. Compare opaque identifiers, signed tokens, cookie protections and sender constraints, then test idle expiry, absolute expiry and revocation across caches and accepting services. Identity & Access
Foundational
Infostealers and Session TheftInfostealer malware collects saved passwords, session cookies, tokens and developer credentials from a machine and uploads them as a log that is sold to people who specialise in breaking into organisations. Stolen session cookies represent logins that already passed MFA, so they can be replayed without a password or second factor. Defences make stolen secrets worthless (phishing-resistant MFA, short and device-bound sessions, no long-lived keys on endpoints), keep work access on managed devices, harden endpoints against lures such as ClickFix, and monitor stealer-log intelligence so sessions are revoked before buyers act. Detection & Response
Advanced
How Browsers Separate Origins: SOP, CORS and CSRFThe same-origin policy lets a page send requests almost anywhere but stops its script reading responses from other origins. CORS is the server's way to relax that read restriction for chosen origins; it never stops a request being sent. CSRF is the attack that exploits sending: a cross-site page makes the victim's browser submit a request with the victim's cookies. The defences are separate: exact CORS allowlists for reads, and for writes a CSRF token, Fetch Metadata checks, strict content types and SameSite cookies as defence in depth. Application Security🔒 Premium