Which of the following is the BEST way to prevent Cross-Site Request Forgery (XSRF) attacks?

The correct answer is A. Check the referrer field in the HTTP header. Cross-Site Request Forgery (CSRF/XSRF) tricks an authenticated user's browser into sending unauthorized requests to a trusted site. Checking the HTTP Referer (referrer) header allows the server to verify that a request originated from a trusted page on the same site, rather…

Threats, vulnerabilities, and mitigations

Question

Options

ACheck the referrer field in the HTTP header
BDisable Flash content
CUse only cookies for authentication
DUse only HTTPS URLs

How the community answered

(45 responses)

A
76% (34)
B
4% (2)
C
7% (3)
D
13% (6)

Explanation

Cross-Site Request Forgery (CSRF/XSRF) tricks an authenticated user's browser into sending unauthorized requests to a trusted site. Checking the HTTP Referer (referrer) header allows the server to verify that a request originated from a trusted page on the same site, rather than from a malicious third-party site. If the referrer does not match the expected domain, the request is rejected. Option B (disabling Flash) addresses a different attack vector. Option C (using only cookies for authentication) actually makes CSRF easier, since cookies are automatically sent with cross-site requests. Option D (HTTPS only) encrypts traffic but does not prevent forged requests from authenticated sessions. Note: Anti-CSRF tokens are generally the strongest defense, but among these options, the referrer check is the best answer.

Topics

#CSRF#cross-site request forgery#HTTP headers#web application security

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice