Security Fundamentals Practice Question 9: CSRF Identification
Security Fundamentals · Test 1 · question 9 of 10
A customer is logged in to her bank's website in one browser tab. In another tab she opens a link to an unrelated page. That page silently submits a hidden form to the bank's "transfer funds" endpoint, and the browser automatically attaches her bank session cookie. The bank processes the transfer. No script ever ran on the bank's own pages. Which vulnerability is this, and which control directly addresses it?
Show answer and explanation
Answer:
OWASP defines CSRF as an attack that occurs when a malicious site, email, or program tricks an authenticated user's browser into performing an unwanted action on a trusted site. The bank trusted the request only because it carried a valid session cookie, and browsers attach cookies automatically. The standard defence is the synchronizer token pattern: every state-changing request must include a large, unpredictable token that a third-party page cannot read. The SameSite cookie attribute adds a further layer of defence (A).
- B is wrong because XSS means attacker script runs *inside* the vulnerable site's pages, and the stem says no script ran on the bank's pages. The two are still connected: OWASP warns that XSS can defeat all CSRF mitigations, so fixing XSS matters too. - C is wrong because nothing was injected into a query. The attacker sent an ordinary, well-formed transfer request. - D is wrong because session fixation involves forcing a known session ID on the victim. Here the attacker never knows or sets the session ID. They simply make the victim's browser use its own session.
Reference: OWASP Cross-Site Request Forgery Prevention Cheat Sheet