Developers are hardening the city's online payments site against injection and session theft. Which application-security pairing is most relevant?
Select an answer to reveal the explanation.
Short Explanation
The payments site needs a bouncer at the door and a lock on the session cookie. Validate what users send in, and mark cookies Secure/HttpOnly so browsers do not casually leak them. Turning off HTTPS or auth is the opposite of hardening.
Full Explanation
Input validation reduces injection and malformed-data risks by constraining what the application accepts. Secure cookie attributes (such as Secure and HttpOnly) help protect session tokens from theft via cleartext transport or script access. Disabling HTTPS, trusting all input, or removing authentication increases exposure on a payments site. These application security techniques are in-scope for Domain 4.1.