Web Application Security
Assesses practical judgment in web application security: injection, XSS, CSRF, sessions, passwords, secrets and access control. Suited for back-end, full stack and AppSec developers.
Sample questions
Taken from the template itself. Questions with a recorded answer key are left out, so reading this page cannot help anyone pass the test.
As the candidate sees it
Web Application Security
- 1.Short text
Which HTTP header makes the browser access the site only over HTTPS on future visits?
The site already redirects HTTP to HTTPS, but the first request of each visit still goes out over HTTP and can be intercepted. Answer with the header name and, optionally, an example value.
- 2.Long text
How would you investigate, fix and prevent the return of this access control flaw?
A customer reported that, after changing the number in the URL GET /api/invoices/10453 to 10454, they saw another company's invoice, with tax ID, address and amounts. The API uses JWT and IDs are sequential. Describe: how to confirm the issue and measure its impact, the code fix, what to do about possibly exposed data (including Brazil's LGPD) and how to stop the problem from coming back in other endpoints.
- Shown once you copy the template
- Shown once you copy the template
- Shown once you copy the template
6 more questions in the full template.
How this template was made, and what you can check
Are these the real questions?
Yes. The questions on this page are the questions a candidate gets. They are not samples written for the site: they come from the template itself, word for word.
Why are some questions missing from this page?
Any question with a recorded answer key is left out, so that reading this page cannot help anyone pass. The count of what is missing is shown; the questions themselves appear once you copy the template.
Which language does the candidate see?
Every template exists in English and Portuguese. The candidate answers in theirs and you read in yours.
Will this template work on my plan?
Question types are checked against your plan by the database itself, so a template never promises a type your plan cannot run. Building assessments and collecting answers is free; automatic scoring starts on the Starter plan.
Can I change the questions?
Once you copy it, the template is yours: change the wording, drop a question, add your own. None of this is fixed.
How fast can I send it?
Create a free account, copy the template and share the link. The candidate opens it in the browser, with nothing to install.
Use this template on your next opening
Copy the template, change what you want, send a link. Assessly marks each answer, scores it and explains the score.
What comes back to you
Short text
Which HTTP header makes the browser access the site only over HTTPS on future visits?
Answer
Score
Why this score
The question is real. The answer and the score are drawn as an example of what a review looks like.