CyberCertPrepSecurity FundamentalsWeb Security BasicsEASYFree question
What is a Cross-Site Request Forgery (CSRF) attack?
- A.Injecting SQL into forms; HTTP is a stateful protocol that tracks each user automatically, and session tokens exist purely to speed up page rendering rather than to identify the requester
- B.Forging a website's SSL certificate; transport encryption also validates the structure of every request body, which is why an application served over TLS cannot be reached by malformed or oversized input
- C.Creating a fake website
- D.Tricking a user's browser into making unwanted requests to a site where they are authenticated, performing actions without their knowledge
Why D is correct
CSRF tricks authenticated users into performing unintended actions (changing email, transferring money) by loading malicious requests from a different site. The user's browser automatically includes session cookies. Prevention: CSRF tokens, SameSite cookie attribute, and checking Origin/Referer headers.
Know someone studying for Security Fundamentals? Send them this one.