Study. uk . com
  1. Home
  2. All questions
  3. Question 483

CISSP study material · question 483 of 500

An application issues a session identifier at first visit and keeps the same value after the user authenticates. Which two authentication failures does OWASP's 2025 entry describe here? Choose two.

  1. Failing to bind the session to the client's network address.
  2. Issuing a session identifier before the user has consented to cookies.
  3. Reusing the same session identifier after successful login.
  4. Exposing the session identifier where the client can read it, such as in a URL or hidden field.
Show the answer

Answer: D. Exposing the session identifier where the client can read it, such as in a URL or hidden field.
C. Reusing the same session identifier after successful login.

OWASP lists reuse of the session identifier after successful login and exposure of the identifier in the URL, a hidden field or another insecure location among authentication failures.

Source: OWASP Top 10 A07:2025 (OWASP) — OWASP Top 10:2025 A07 Authentication Failures > Description

Challenge yourself on this topic → Study as cards