Cookies, caching and CORS

Questions 1 to 5 of 10

1. 1. A login route sends this header. The login works in the server's own log, but a browser never keeps the cookie. Which part is the bug? ``python handler.send_header( "Set-Cookie", "session=MiHFJraq3J; HttpOnly; Path=/; SameSite=None", ) ``

   Path=/ should name the login page insteadHttpOnly and SameSite cannot be used in the same headerSameSite=None needs Secure, so the browser ignores the cookie without itThe session value is too short to be a real session id
2. 2. Logout should end the login. After this route runs, replaying the old cookie value still gets Hello, maya from /me. What is the bug? ``python def logout(self): self.send_response(200) self.send_header("Set-Cookie", "session=; HttpOnly; Path=/; Max-Age=0") self.end_headers() self.wfile.write(b"logged out\n") ``

   The server never removes the session record, so the old id still matches oneMax-Age=0 is the wrong way to clear a cookieThe logout route must use GET so the browser sends the cookieThe response needs a Content-Length header before it can clear a cookie
3. 3. True or false: a cookie set with Max-Age=1800 ends the server-side login after 30 minutes.

   True, because the server reads Max-Age and deletes its own recordFalse, because Max-Age only tells the browser when to delete its copy, and the server keeps its own recordTrue, because a cookie stops being sent after Max-Age, so the server forgets the userFalse, because Max-Age is ignored whenever HttpOnly is set
4. 4. True or false: a response with Cache-Control: no-cache is never stored by the browser.

   True, because no-cache means no-storeTrue, because the stored copy is deleted after one useFalse, because no-cache allows storing the copy, but the browser must check with the server before each reuseFalse, because no-cache only applies to shared caches
5. 5. A login cookie has SameSite=Lax. A form on evil.example sends a POST to bank.example. What does the browser do with the cookie?

   It does not send the cookie, because Lax skips cross-site POST requestsIt sends the cookie, because Lax sends it on every requestIt sends the cookie, because a form that POSTs counts as same-siteIt sends the cookie only when the form uses HTTPS