Cross-Site Request Forgery (CSRF) - GET and POST Methods WAHS Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A web application allows users to change their email address via a GET request to /profile/email?new=attacker@example.com. An authenticated user visits a forum where an attacker has posted a message containing an <img> tag pointing to that URL. The user's browser automatically requests the image. Which statement best describes why this is a CSRF vulnerability?

   • AThe attacker has stolen the user's session cookie and is replaying it to impersonate the user.
   • BThe server trusts the user's session cookie and processes the GET request as a state-changing action without additional confirmation.
   • CThe server fails to validate the Referer header, allowing the image request to be accepted from any domain.
   • DThe image tag bypasses the browser's same-origin policy, allowing the attacker to read the user's email address from the response.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A web application uses a POST form to change a user's password. The form includes a hidden anti-CSRF token. An attacker wants to perform CSRF. Which condition would allow the attack to succeed?

   • AThe victim has JavaScript disabled
   • BThe application uses SameSite=None cookies
   • CThe victim is not authenticated
   • DThe attacker can predict or obtain the anti-CSRF token
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A web application uses a custom header X-Requested-With to distinguish AJAX requests from normal form submissions. The server only processes POST requests that include this header. An attacker wants to perform a CSRF attack using an auto-submitting form. Why is this defense effective?

   • AThe header is tied to the session cookie, so the attacker cannot forge it.
   • BThe header is automatically added by the browser for all cross-origin requests, so the server can verify it.
   • CCross-origin forms cannot set custom headers, so the forged request will not include X-Requested-With and will be rejected.
   • DThe header contains a CSRF token that changes with each session.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A web application uses a GET request to allow users to change their password: /user/password?new=... The application relies on session cookies and does not use CSRF tokens. An attacker wants to exploit this. Which of the following is the most effective way to trigger the CSRF attack?

   • AUse a <script> tag to load the URL.
   • BUse an auto-submitting form with method=POST.
   • CEmbed an <img> tag with the URL in a page the victim visits.
   • DUse JavaScript fetch() to send a cross-origin GET request.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A web application changes a user's email address via a POST request to /account/email with parameters email and confirm. The application relies on session cookies for authentication. An attacker wants to change the victim's email without the victim's knowledge. Which approach would be most effective?

   • AEmbed an <img> tag pointing to the endpoint with query parameters
   • BUse a <script> tag with the endpoint as src
   • CSend a cross-origin XHR request from JavaScript
   • DCreate a page with an auto-submitting form that POSTs to the target endpoint
   Reveal Solution Discussion Select an answer first