Study. uk . com
  1. Home
  2. All questions
  3. Question 153

CompTIA Security+ study material · question 153 of 611

Why can a server not distinguish a cross-site request forgery from a legitimate request using cookies alone?

  1. Because cookies are encrypted end to end
  2. Because forged requests always use a different HTTP method
  3. Because the Referer header is stripped by proxies
  4. Because the browser attaches the victim's cookies automatically to both
Show the answer

Answer: D. Because the browser attaches the victim's cookies automatically to both

Ambient authority means both requests look authenticated, so an extra unguessable token is needed.

Source: OWASP Cross-Site Request Forgery Prevention Cheat Sheet (OWASP) — OWASP Cross-Site Request Forgery Prevention Cheat Sheet › Introduction

Challenge yourself on this topic → Study as cards