Web Security · Junior · Question 8 of 75
Which data from the browser can the server trust without checking?
- 1Cookies, because the browser stores them
- 2Hidden form fields, because the user can't see them
- ✓Correct answer: None of it: body, query, headers and cookies can all be changed by the client
Explanation
The client fully controls what it sends. Even a hidden price field or a role cookie can be edited, so the server must rely on its own data and checks.