CyberCertPrepWeb App FundamentalsCommon Web Vulnerabilities (OWASP Intro)EASYFree question
A web application has an 'account delete' feature accessible via a GET request: '/api/deleteAccount?id=123'. A malicious website embeds '<img src="https://app.example.com/api/deleteAccount?id=123">'. What is this attack and what is the fix?
- A.XSS via img src injection
- B.CSRF exploiting a state-changing GET endpoint: the img tag triggers an authenticated GET request from the victim's browser using their session cookie. Fix: (1) never use GET for state-changing operations; (2) use POST with CSRF token validation; (3) implement SameSite cookie attributes
- C.Clickjacking via embedded img tag
- D.SSRF via the img src request
Why B is correct
Using GET for state-changing operations (delete, payment, password change) violates HTTP semantics and enables drive-by CSRF via passive content (img, script, link, iframe src attributes). Browsers automatically fetch these URLs with credentials. The fix is twofold: use POST (not automatically triggered by passive elements) for all state changes, and add CSRF token validation on POST handlers. SameSite cookie attributes provide additional protection.
Know someone studying for Web App Fundamentals? Send them this one.