Cross-Site Request Forgery (CSRF) - GET and POST Methods WAHS Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A penetration tester is assessing a web application that uses GET requests for state-changing actions and relies on SameSite=Lax cookies. The tester wants to demonstrate a CSRF attack. Which approach would be most likely to succeed?

   • AUse a <script> tag to load the URL
   • BUse a top-level navigation link that the victim clicks
   • CUse an <img> tag embedded in a malicious page
   • DUse a POST form with auto-submit
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A web application uses a CSRF token stored in a cookie and also requires the token in a custom header for AJAX requests. The application also accepts form submissions without the header. An attacker crafts an auto-submitting form. Why does this attack succeed?

   • AThe server does not require the custom header for form submissions, so the CSRF token in the cookie is not validated.
   • BThe attacker can read the CSRF token from the cookie and include it in the form.
   • CThe browser automatically adds the custom header to form submissions.
   • DThe CSRF token in the cookie is not sent with the form submission.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is hardening a legacy web application that uses session cookies without the Secure flag. The application has both GET and POST state-changing endpoints. The team wants to minimize user disruption while adding CSRF protection. Which approach best balances security and usability?

   • AImplement a synchronizer token for POST requests and change GET state-changing endpoints to POST.
   • BSet SameSite=Strict on all cookies and require a custom header for all requests.
   • CUse a double-submit cookie pattern for all requests and rely on the browser's SameSite default.
   • DAdd a CAPTCHA to all state-changing requests.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A web application currently uses SameSite=Lax cookies and anti-CSRF tokens for POST forms. The team wants to add a new feature that allows cross-site embedding of a widget that performs GET-based actions. Which change would maintain CSRF protection while allowing the widget to work?

   • AUse SameSite=Strict and allow the widget to use POST requests
   • BKeep SameSite=Lax and require a custom header on all GET requests
   • CRemove anti-CSRF tokens and rely on SameSite=Lax
   • DChange cookies to SameSite=None and rely on anti-CSRF tokens for all state changes
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A banking application changes a user's transfer limit via a POST request to /account/limit with parameters amount and currency. The application relies on the session cookie for authentication and does not use any CSRF token. An attacker crafts an auto-submitting HTML form that posts to the banking site. What is the most effective defense to add to the application?

   • ARequire the user to re-enter their password for every limit change.
   • BChange the request method from POST to GET so it is easier to log and monitor.
   • CValidate the Content-Type header to ensure it is application/x-www-form-urlencoded.
   • DInclude a synchronizer token in the form and validate it on the server for every state-changing POST request.
   Reveal Solution Discussion Select an answer first