Which web security attack causes a logged-in user's browser to send…
2024
Which web security attack causes a logged-in user's browser to send unauthorized requests to a trusted web application without the user's intentional consent?
Answer: C. CSRF (Cross-Site Request Forgery) — ConceptBrowsers automatically attach ambient credentials, especially session cookies, to matching requests. A web application must therefore distinguish a…
- A.
Phishing
- B.
SQL Injection
- C.
CSRF (Cross-Site Request Forgery)
- D.
Spoofing
- E.
Session Hijacking
Attempted by 198 students.
Show answer & explanation
Correct answer: C
Concept
Browsers automatically attach ambient credentials, especially session cookies, to matching requests. A web application must therefore distinguish a user-intended state-changing request from one triggered by another site.
Cross-Site Request Forgery (CSRF) exploits this credential attachment: the request is sent through the victim’s authenticated browser even though the victim did not intentionally authorize the action.
Application
The user first signs in to a trusted web application, which creates an authenticated session in the browser.
The user then opens an attacker-controlled page or link that triggers a request to the trusted application.
The browser automatically includes the trusted application’s session cookie with that request.
Without an anti-CSRF check, the application accepts the authenticated request and performs the state-changing action.
Cross-check and contrast
Phishing depends on persuading the person to disclose information or act through social engineering.
SQL Injection changes the meaning of a server-side database query through crafted input.
Spoofing misrepresents an apparent identity or origin.
Session Hijacking gives the attacker control of an existing session identifier.
The defining clues here are the already logged-in browser, its automatic credentials, and an attacker-triggered unauthorized request. Those clues identify CSRF (Cross-Site Request Forgery).