Daily security quiz #7

Question for 2026-11-07. Read the code and pick the most serious security vulnerability.

This code stores login state in a cookie and reads it back. What is the most serious vulnerability?

1import base64, pickle
2 
3def save_session(resp, session: dict):
4    data = base64.b64encode(pickle.dumps(session)).decode()
5    resp.set_cookie("session", data)
6 
7def load_session(req) -> dict:
8    raw = req.cookies.get("session")
9    return pickle.loads(base64.b64decode(raw)) if raw else {}

1. Abase64 is not encryption, so the session contents are visible
2. BThe cookie size may exceed 4KB
3. CDeserializing user-supplied data with pickle allows arbitrary code execution on the server
4. Dset_cookie has no expiration time