CyberCertPrepWeb App FundamentalsCookies & SessionsEASYFree question
An application validates a CSRF token by checking that req.body.csrf_token === req.session.csrf_token. A developer notices this check is missing on one API endpoint. What risk does this introduce on that endpoint?
- A.The endpoint is vulnerable to CSRF: a malicious page on another origin can submit a form or make a fetch request to this endpoint using the victim's credentials (cookies), performing state-changing actions without their consent
- B.The endpoint is only vulnerable if it accepts file uploads
- C.Missing CSRF validation only matters for unauthenticated endpoints
- D.The risk is XSS not CSRF since the token is checked in the body
Why A is correct
Even one unprotected state-changing endpoint breaks the CSRF protection strategy. An attacker can specifically target the unprotected endpoint. CSRF validation must be consistently applied to all state-changing routes - a security review checklist should include verifying every POST/PUT/PATCH/DELETE endpoint has CSRF protection, or the application uses SameSite=Strict/Lax cookies consistently.
Know someone studying for Web App Fundamentals? Send them this one.