Which of the following is the BEST definition of Cross-Site Request Forgery (CSRF)?

Question

Options

• AAn attack which forces an end user to execute unwanted actions on a web application in which
• BAn attack that injects a script into a web page to execute a privileged command
• CAn attack that makes an illegal request across security zones and thereby forges itself into the
• DAn attack that forges a false Structure Query Language (SQL) command across systems

• A
  93% (13)
• B
  7% (1)

Explanation

An attack which forces an end user to execute unwanted actions on a web application in which they are currently authenticated is the best definition of Cross-Site Request Forgery (CSRF). CSRF is a type of web-based attack that exploits the trust relationship between a web browser and a web server. CSRF occurs when an attacker tricks or coerces an end user to visit a malicious website or click on a malicious link, which then sends a forged request to a web application that the end user is already logged in to. The web application, assuming that the request is legitimate and authorized, executes the request and performs the action that the attacker intended, such as transferring funds, changing passwords, or deleting data. The end user may not be aware of the CSRF attack, as it happens in the background and does not require the user's input or consent. CSRF can compromise the security and privacy of the end user and the web application, and cause financial or reputational damage to both parties.

No community discussion yet for this question.