CyberCertPrepSecurity FundamentalsWeb Security BasicsEASYFree question
What is a Cross-Site Request Forgery (CSRF) attack?
- A.A. Forging a website's SSL certificate
- B.D. Injecting SQL into forms
- C.C. Creating a fake website
- D.B. Tricking a user's browser into making unwanted requests to a site where they are authenticated, performing actions without their knowledge
Why D is correct
CSRF tricks authenticated users into performing unintended actions (changing email, transferring money) by loading malicious requests from a different site. The user's browser automatically includes session cookies. Prevention: CSRF tokens, SameSite cookie attribute, and checking Origin/Referer headers.
Know someone studying for Security Fundamentals? Send them this one.