Web Security · Senior · Question 5 of 75
Why are secure defaults important in a shared internal library or framework?
- 1Because defaults can't be changed later
- 2Because defaults make the bundle smaller
- ✓Correct answer: Most developers use the default; if it's safe, the whole codebase is safe without extra effort
Explanation
Auto-escaping templates and HttpOnly session cookies by default prevent entire bug classes. Unsafe options should need explicit, visible opt-in.