Question

A cloud-native e-commerce service accepts serialized session objects from clients and reconstructs them server-side using the language's native deserialization function. During a threat modeling review, a security engineer flags that an attacker could craft a malicious serialized payload to execute code on the application server. Which mitigation most directly addresses the root cause of this OWASP vulnerability?

Accepted Answer

Accept only primitive data types via a defined schema (e.g., JSON) and reject native binary object deserialization from untrusted sources

Answer

Enforce TLS 1.3 on all client connections so serialized payloads cannot be intercepted in transit

Answer

Place a web application firewall in front of the service to rate-limit incoming session requests

Answer

Store session objects in an encrypted cloud key-value cache instead of returning them to the client