I'm developing a Drupal site for a government organisation and am required to fill in a security assessment form. The form asks for confirmation that the "application" (Drupal in this case) takes steps to mitigate against threats and attacks that can exist as a result of inadequate data validation and encoding, including form field manipulation, cookie manipulation, and HTTP header manipulation.
The specific questions asked are:
- Are cookies validated?
- Are HTTP headers (e.g. Referer and User-Agent) validated?
I can answer from the point of view of my own application (it uses and validates a couple of cookies, does no validation of HTTP headers). How should I answer in terms of what Drupal core does?