Cross-Site Request Forgery (CSRF) - GET and POST Methods WAHS Practice Questions (Page 8)

Questions 36–37

1. 36application · medium

   A company's web application uses SameSite=Lax cookies for session management. A user is logged in and clicks a link on an external site that triggers a GET request to change their password. The browser sends the request but does not include the session cookie. Which statement best explains this behavior?

   • ASameSite=Lax blocks all cross-site requests, including top-level navigations, so the cookie is not sent.
   • BSameSite=Lax prevents cookies from being sent on cross-site subresource requests, but allows them on top-level navigations like clicking a link.
   • CThe cookie is not sent because the external site is not in the same-site list.
   • DThe browser strips the cookie because the request is a GET and the action is state-changing.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the typical sequence of events in a CSRF attack?

   • AVictim logs in, attacker steals the session cookie, attacker replays the cookie to perform actions.
   • BAttacker exploits a vulnerability to upload a malicious script, the script runs in the victim's browser, and the script sends requests to the application.
   • CAttacker sends a phishing email, victim clicks a link, attacker captures the victim's credentials.
   • DVictim authenticates to the application, attacker tricks the victim's browser into sending a crafted request, the application processes the request using the victim's session.
   Reveal Solution Discussion Select an answer first