CCSP · Question #630
Which of the following threat types involves leveraging a user's browser to send untrusted data to be executed with legitimate access via the user's valid credentials?
The correct answer is D. Cross-site request forgery. Cross-Site Request Forgery (CSRF) tricks a user's authenticated browser into sending a forged HTTP request to a target site. Because the browser automatically includes the user's session cookies or credentials, the server sees the request as legitimate. The attacker does not…
Question
Which of the following threat types involves leveraging a user's browser to send untrusted data to be executed with legitimate access via the user's valid credentials?
Options
- AInjection
- BMissing function-level access control
- CCross-site scripting
- DCross-site request forgery
How the community answered
(29 responses)- A3% (1)
- B3% (1)
- D93% (27)
Explanation
Cross-Site Request Forgery (CSRF) tricks a user's authenticated browser into sending a forged HTTP request to a target site. Because the browser automatically includes the user's session cookies or credentials, the server sees the request as legitimate. The attacker does not steal the credentials - instead, they exploit the trust the server places in the authenticated session. This distinguishes CSRF from XSS (which injects malicious scripts into a page), injection (which manipulates queries or commands), and missing function-level access control (which is about improper authorization checks on the server side).
Topics
Community Discussion
No community discussion yet for this question.