101 · Question #341
CSRF is difficult to detect because:
The correct answer is A. The attacks are requests a user should be allowed to make. CSRF attacks are hard to detect because the forged requests are indistinguishable from legitimate user requests - the server has no way to tell the difference.
Question
CSRF is difficult to detect because:
Options
- AThe attacks are requests a user should be allowed to make
- BThe attacks always utilize obfuscation
- CThe attacks are always encrypted
- DAll of the above
How the community answered
(53 responses)- A94% (50)
- B2% (1)
- C2% (1)
- D2% (1)
Why each option
CSRF attacks are hard to detect because the forged requests are indistinguishable from legitimate user requests - the server has no way to tell the difference.
Cross-Site Request Forgery exploits the fact that browsers automatically include session cookies and authentication tokens with every request to a site. From the server's perspective, the forged request looks identical to one the user intentionally initiated, making detection impossible without anti-CSRF tokens or same-site cookie policies.
Obfuscation is not a defining characteristic of CSRF - the attack works by tricking the browser into sending a plain, valid-looking HTTP request, requiring no obfuscation at all.
CSRF attacks operate at the application layer and are not inherently encrypted - HTTPS protects data in transit but does not prevent a forged request from being sent or received.
Since B and C are both technically incorrect as universal characteristics of CSRF, 'all of the above' cannot be the correct answer.
Concept tested: Cross-Site Request Forgery detection challenges
Source: https://owasp.org/www-community/attacks/csrf
Topics
Community Discussion
No community discussion yet for this question.