CSRF GWEB Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A team is deploying a new web application that will be accessed by users on both modern and older browsers. The application uses cookies for sessions. The team wants to implement CSRF protection that works even in browsers that do not support SameSite attributes. Which defense should be the primary control?

   • AUsing a custom header check on all requests.
   • BServer-side validation of a synchronizer token embedded in forms.
   • CRelying on the Origin header to validate requests.
   • DSetting SameSite=Lax on all cookies.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A penetration tester is assessing a banking application. The tester wants to determine if a fund-transfer endpoint is vulnerable to CSRF. The application uses session cookies without SameSite attributes and does not use anti-CSRF tokens. Which test would most directly confirm the vulnerability?

   • ACraft an HTML page with a form that auto-submits a POST request to the transfer endpoint and observe if the transfer occurs when a logged-in user visits the page.
   • BUse a CSRF scanner that only checks for the presence of anti-CSRF tokens in forms.
   • CInspect the HTTP response headers for the presence of X-Frame-Options.
   • DSend a cross-origin XMLHttpRequest with the Content-Type header set to application/json and check if the server accepts it.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company is building a single-page application (SPA) that uses a REST API with cookie-based authentication. The API is served from api.example.com, and the SPA is served from app.example.com. The SPA needs to make cross-origin requests to the API. The team wants to prevent CSRF while allowing the SPA to function. Which approach is the most appropriate?

   • AUse a synchronizer token in the SPA's local storage and send it as a header.
   • BDisable CORS on the API and serve the SPA from the same origin.
   • CUse SameSite=Lax on the session cookie and rely on it to block cross-site requests.
   • DUse the SameSite=None attribute on the session cookie and require a custom header on API requests.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A web application is deployed behind a CDN that caches responses. The application uses a CSRF token in a hidden form field. The token is generated per session and stored in the server-side session. The team notices that some users receive a cached page with another user's token. What is the most likely cause and the best fix?

   • AThe CDN is caching pages that contain the CSRF token; configure the CDN to not cache pages with forms or use Cache-Control: private.
   • BThe session cookie is not marked Secure; set the Secure flag.
   • CThe token is not being regenerated on login; regenerate the token after authentication.
   • DThe server is using a weak random number generator; use a cryptographically secure RNG.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A penetration tester is assessing a web application for CSRF. The tester finds a state-changing endpoint that accepts both GET and POST requests. The tester wants to prove that a CSRF attack is possible without requiring the victim to click a link. Which proof-of-concept is most effective?

   • AAn XMLHttpRequest to the endpoint with the credentials option set to 'include'.
   • BA JavaScript fetch call that sets the custom header X-Requested-With.
   • CAn HTML page with a form that auto-submits a POST request to the endpoint.
   • DA link that the victim must click to trigger a GET request.
   Reveal Solution Discussion Select an answer first