| Question:
- Let’s suppose Virtual E-Mart is the leading online shopping cart company or web application. They maintain the prices for its each sale item (dresses, shoes, handbags and wallets) in shopping cart.
- They provide special discounts for users based on their past purchases using this online shopping cart. They offer them a special discount ranging from 25%-35%. When a user purchases 8 or more items within six months.
- They also offer a pair of any shoes as a gift, when a particular user purchases 5 sets of clothing at a time.
- When a user purchases 20, 30 or 50 items he becomes a “lucky user” and they provide him silver, golden and diamond view.
- In each view users are shown the latest design of those items which they like the most but not yet advertised in normal view.
Understand the scenario given above and answer the following question.
- 1. Which technique of session tracking Virtual E-Mart should use to keep track of users? Also give reason for choosing the technique for the above mentioned features? (5)
Solution:
Cookies:
- Identification of user: For example, items are added into shopping cart after the identification of user. On the basis of items purchased special discounts offer or gift is made.
- Customizing a site: providing silver, golden and diamond views for “lucky users” of the site.
- Focused Advertising: users are shown the latest design of those items which they like the most but not yet advertised. This is done as focused advertisement.
- 2. If they maintain their systems fields like “prices of items” without using any form of validation. What will be the threat?(5)
Solution:
- Attacker’s threat: Without using any form of validation. When an invoice will be prepared and a credit card is charged, user will blindly trust the prices provided by the shopping carts. Thus, any attacker who wanted to give himself a discount could simply go shopping, save the server’s HTML onto his hard drive, edit the prices, and then click on the “Buy” button.
- If they use hidden fields to store information of user for session tracking.
For example, instead of using HTTP Basic Authentication, developers sometimes embed the username and password provided by the user as hidden fields in all the forms in which user fill information to purchase an item.
Give one advantage and one disadvantage of using hidden fields in this scenario .(5)
Solution:
- Advantage: It’s quite easy to use hidden fields. Little or no information needs to be stored on the server. And unlike cookies, which are limited to 4096 bytes, hidden fields can be practically any length whatsoever.
- Disadvantage: If the user presses the “Back” button, items may be removed from the shopping cart. Sometimes this is the desired behavior, but usually it is not.
Note: Your explanation must justify enough for 5 marks for each question. |
