TCS Security API Quiz

setRememberToken is generally not recommended because persistent authentication tokens increase security risk. If compromised, they provide long-term access without requiring re-authentication. Best practice is to use short-lived sessions requiring periodic re-authentication.

The security API provides four logging levels: trace (most detailed), warn (warnings), error (errors), and fatal (critical failures). Option B lists six levels commonly found in general logging frameworks, but this specific security API implements a simpler four-level model.

To prevent XSS, TCS SAPI uses both isSafeHTML() to validate input and encodeForHTML() to encode it. Validation alone is insufficient - encoding is necessary to neutralize malicious scripts. The correct option A includes both prevention methods.

EnterpriseSecurityException is the base class for all security-related exceptions in this API. While SecurityException might seem logical, this specific API hierarchy uses EnterpriseSecurityException as the root. EnterpriseException is likely a broader base for all enterprise exceptions.

The hash function uses accountName as the salt value. This ensures each account has a unique salt, preventing rainbow table attacks even if two users have the same password. A constant salt would be ineffective, and using the password itself as salt would defeat the purpose.

Canonicalization reduces an encoded string to its simplest, equivalent form. For example, %41 (URL encoding) canonicalizes to 'A'. This is crucial for security because attackers can use multiple encodings to bypass filters - canonicalization reveals the true input.

The sign() method creates a digital signature for the input data and returns it as a string. Digital signatures provide authentication and integrity verification - they prove the data originated from a specific source and wasn't tampered with. This is different from encryption (confidentiality) or hashing (one-way).

To prevent path traversal attacks, TCS SAPI provides isSafeDirectoryPath() and isSafeFileName(). Both methods take a context, input string, and allowNull flag. The 'isSafe' prefix methods (option C) are the correct API methods for validating path safety.

The correct signature is String hashPassword(String password, String accountName). The accountName is used as the salt, so it's required. Option A is missing the salt parameter, and option C has incorrect case (hashpassword instead of hashPassword).

The verifyPasswordStrength() method returns void because it doesn't return a value - it's typically a validation method that throws exceptions or callbacks for weak passwords. Password strength verification usually provides feedback through side effects, not return values.

Methods following the 'is' naming convention in Java typically return boolean values. The isAuthorizedForData() method checks authorization status, so boolean is the appropriate return type to indicate whether authorization is granted or denied.

CSRF tokens are typically string-based identifiers passed in HTTP headers or form parameters. The getCSRFToken() method returns the token as a String for easy integration with web requests and security validation.

The login method throws SecurityException when authentication fails or security violations occur during the login process. This is a standard exception type for security-related failures in Java security APIs, providing a clear indication of security-related issues.

The security API includes default scripting codecs for both JavaScript (JavaScriptCodec) and VBScript (VBScriptCodec). These codecs encode user-supplied data specifically for execution within client-side script contexts, preventing cross-site scripting (XSS) attacks by neutralising script-specific characters before output rendering.

The security API provides default codecs for Unix/Linux (UnixCodec) and Windows (WindowsCodec) to escape input intended for OS command shells. These codecs prevent command injection vulnerabilities by encoding metacharacters specific to each operating system's command interpreter, ensuring input is treated purely as data.

The security API (OWASP ESAPI) contains built-in codecs for both Oracle (OracleCodec) and MySQL (MySQLCodec) to prevent SQL injection attacks. While other databases can also be supported via custom implementations, these two databases are explicitly covered by default SQL codecs provided in the core library.

The seal method in ESAPI encrypts data and embeds an expiration timestamp. This creates a secure token ensuring that the package cannot be tampered with or read, and will be rejected as invalid once the expiration timestamp has passed.

Cache control headers must be set on the HttpServletResponse object, not the HttpServletRequest. The method returns void as it performs an action (setting headers) rather than returning a value. ServletException is not relevant to header operations, making option A the correct signature.

Preventing Cross Site Request Forgery requires associating requests with a unique, unpredictable, and user-specific token. The addCSRFToken method appends this token to URLs, verifying that the request originated from the authenticated user rather than an external site.

Cross-Site Scripting (XSS) occurs when untrusted input is executed in the browser. Input validation restricts malicious data from entering the application, and output encoding prevents the browser from interpreting user input as executable code, forming the best defense.