OAuth Access Token Security Quiz: Best Practices for Secure Storage and Handling Quiz

1. Understanding Secure Token Storage

   Which method is generally recommended for securely storing OAuth access tokens on a mobile device?

   1. Using the device's secure storage system, such as Keystore or Keychain
   2. Storing in plain text files within the app's directory
   3. Saving in browser localStorage without encryption
   4. Committing the token directly into the app's codebase
   5. Including the token as a query parameter in URLs

2. Client Secret Handling

   When using the OAuth client credentials flow, how should the client secret be stored?

   1. In an environment variable or securely managed server-side secret store
   2. In JavaScript files sent to the browser
   3. As a public constant within the app's code
   4. In cookies accessible via JavaScript
   5. Written in comments in the code

3. Danger of Token Exposure

   What is a major risk if you accidentally commit OAuth access tokens or client secrets to a public code repository?

   1. Unauthorized users may use the credentials to access protected resources
   2. Your app will gain performance benefits
   3. Tokens will automatically renew themselves for additional security
   4. The application will stop working offline
   5. Tokens become encrypted by default

4. Best Practice for Token Revocation

   What should your application do when an OAuth access token is no longer needed, such as on user logout?

   1. Revoke and delete the token from all storage
   2. Keep the token for future reuse
   3. Email the token to the user
   4. Store the token in browser session storage indefinitely
   5. Archive the token in a database backup

5. Avoiding Token Hardcoding

   Why is it a bad idea to hardcode OAuth access tokens in source code or configuration files?

   1. They may be accidentally exposed and used by unauthorized parties
   2. It increases app battery usage
   3. Hardcoded tokens cannot be revoked
   4. Tokens will expire more quickly
   5. Token refresh will stop working

6. Minimizing Token Scope

   According to OAuth best practices, what is the recommended approach when requesting user authorization scopes?

   1. Request only the minimum scopes needed for the current task
   2. Always request all possible scopes at the initial authentication
   3. Request scopes randomly to diversify permissions
   4. Use the same set of scopes for every user regardless of their actions
   5. Combine multiple tokens to increase privilege

7. Selecting Storage Location for Web Apps

   In a web application, where is the most secure location to temporarily store an access token during an active session?

   1. In application memory (such as a JavaScript variable)
   2. In browser localStorage
   3. Inside an HTML data attribute
   4. Within an unsecured cookie
   5. Written to the console log

8. Handling Token Expiry

   If an access token expires and a refresh token is available, what should your application do?

   1. Use the refresh token to obtain a new access token
   2. Continue sending requests with the expired token indefinitely
   3. Prompt the user to restart the application
   4. Manually edit the access token's expiration date
   5. Ignore token expiration and proceed

9. Native vs Embedded Authentication

   For mobile or desktop apps, what is the best practice for presenting OAuth authorization to users?

   1. Use the device's native browser for the OAuth flow
   2. Embed the authorization page in a webview
   3. Hardcode the expected access token
   4. Send the user a plain text email with the token
   5. Use an iframe to display the authorization page

10. Token Management on Logout

    Upon logout in a typical application, which is the correct way to handle stored OAuth access and refresh tokens?

    1. Delete them from all storage and notify the authorization server to revoke them
    2. Keep them in memory for the next user session
    3. Export them to an external file
    4. Email them to the administrator for backup
    5. Store them in logs to audit access