What mechanism is typically exploited in a Cross-Site Request Forgery (CSRF) attack?

Question

Options

• AThe user's trust in their browser's security
• BThe server's trust in user input
• CThe server's trust in that the user has authenticated
• DThe application's trust in dynamic script execution

• A
  3% (1)
• B
  3% (1)
• C
  91% (31)
• D
  3% (1)

Explanation

CSRF exploits the server's trust that an authenticated user's requests are intentional. When a user is logged into a site, their browser automatically sends session cookies with every request to that domain - a CSRF attack tricks the browser into making a malicious request that the server accepts as legitimate because the authentication credentials look valid.

Why the distractors are wrong:

• A is off-target: CSRF doesn't exploit browser security flaws - it actually abuses correct browser behavior (automatic cookie sending).
• B describes SQL injection or input validation issues, not CSRF - the server isn't blindly trusting unvalidated input, it's trusting a properly authenticated session.
• D describes XSS (Cross-Site Scripting), which abuses dynamic script execution - a completely different attack vector.

Memory tip: Think of CSRF as a "forged signature" attack - the server sees what looks like a legitimate signed request (authenticated session) but the user never actually wrote it. The key word is forgery of an authenticated action, so trust in authentication = C.

No community discussion yet for this question.