CSRF GWEB Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A web application allows users to transfer money between accounts. The transfer is performed via a POST request that includes the amount and destination account. The application uses cookie-based sessions. Which scenario represents a successful CSRF attack?

   • AThe attacker directly sends a POST request to the transfer endpoint using the attacker's own session.
   • BThe attacker uses a cross-site scripting vulnerability to steal the victim's session cookie and then replays it.
   • CThe victim visits an attacker-controlled page that contains a form auto-submitting a POST to the transfer endpoint with the attacker's account as the destination.
   • DThe victim clicks a link that opens the transfer page but does not submit the form.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is migrating a legacy web application to a microservices architecture. The application currently uses a single server-side session and synchronizer tokens. In the new architecture, the frontend service handles the session, and multiple backend services process state-changing requests. The team wants to maintain CSRF protection. Which approach is the most appropriate?

   • AHave the frontend service generate a CSRF token, store it in the session, and include it in a header that backend services validate.
   • BDisable CSRF protection because the backend services are internal and not directly accessible to users.
   • CRely on SameSite=Lax on the session cookie and remove token validation.
   • DUse a shared secret in each backend service to generate and validate tokens independently.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary characteristic of a Cross-Site Request Forgery (CSRF) attack?

   • AAn attacker tricks the victim's browser into sending an unintended, authenticated request to a web application.
   • BAn attacker floods the application with requests to exhaust server resources and cause denial of service.
   • CAn attacker injects malicious script that executes in the victim's browser and steals session cookies.
   • DAn attacker intercepts and modifies the HTTP request between the client and server to change its content.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A web application has a feature that allows users to change their email address. The feature is implemented as a GET request with query parameters. A security review recommends changing this to a POST request and adding CSRF protection. Which of the following is the primary reason for this recommendation?

   • APOST requests are inherently more secure than GET requests.
   • BGET requests are cached by browsers, causing stale data.
   • CGET requests are more likely to be logged in proxy servers, exposing sensitive data.
   • DGET requests can be triggered by image tags, making them vulnerable to CSRF without user interaction.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A QA tester is tasked with verifying that a web application is protected against CSRF. The tester has access to a valid session and wants to test a state-changing endpoint. Which test is most likely to confirm the presence of CSRF protection?

   • AVerify that the endpoint only accepts POST requests.
   • BSend a request with a valid CSRF token and observe if the server accepts it.
   • CSend a request to the endpoint without including the CSRF token and observe if the server rejects it.
   • DCheck if the session cookie has the SameSite attribute set to Lax.
   Reveal Solution Discussion Select an answer first