CSRF GWEB Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A web application allows users to change their email address via a form that submits a POST request. The form does not include any CSRF protection. An attacker crafts a malicious page that auto-submits a form to the vulnerable endpoint. Which single defense would most effectively block this attack while requiring the least change to the existing form handling code?

   • AAdd a CAPTCHA to the form.
   • BChange the form method from POST to GET.
   • CSet the SameSite attribute on the session cookie to None.
   • DAdd a hidden anti-CSRF token to the form and validate it on the server.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A development team is implementing CSRF protection for a legacy application that uses multiple forms across the site. The team wants to minimize code changes while providing a consistent defense. Which approach is the most maintainable?

   • ASet SameSite=Lax on all cookies and rely on that as the sole defense.
   • BUse a JavaScript library to add tokens to all AJAX requests.
   • CImplement a global filter that validates a CSRF token on every state-changing request.
   • DAdd a hidden token field to each form manually and validate in each controller.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is the most effective defense against CSRF attacks?

   • AUsing a custom header like X-Requested-With to identify AJAX requests.
   • BRelying on the SameSite cookie attribute set to 'Lax' to block all cross-site requests.
   • CUsing a unique anti-CSRF token that is validated on the server for every state-changing request.
   • DChecking the HTTP Referer header to ensure requests originate from the same domain.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A penetration tester is testing a web application that uses a CSRF token in a hidden form field. The tester notices that the token is not tied to the user's session; it is a static value that is the same for all users. Which test would best demonstrate the CSRF vulnerability?

   • AAttempt to read the token from the victim's browser using JavaScript.
   • BCreate a forged form using the static token and submit it to the target endpoint.
   • CSend a request without any token and observe if the server rejects it.
   • DCheck if the token is in the URL of the form action.
   Reveal Solution Discussion Select an answer first
6. 5application · hard

   A security auditor is reviewing a web application's source code. The auditor finds that the application uses a CSRF token, but the token is stored in a cookie that is also sent with requests. The server validates the token by comparing the cookie value to the request parameter. Which weakness does this design introduce?

   • AAn attacker can read the token from the cookie and include it in a forged request.
   • BThe cookie-based token is automatically included in cross-site requests, so the attacker can submit a valid token without knowing it.
   • CThe token is vulnerable to session fixation because the cookie is not marked Secure.
   • DThe token is not bound to the user's session, so an attacker can reuse a token from their own session.
   Reveal Solution Discussion Select an answer first