Study. uk . com
  1. Home
  2. All questions
  3. Question 154

CompTIA Security+ study material · question 154 of 611

Why does a synchroniser token defeat cross-site request forgery?

  1. It ties the session to a single IP address
  2. It forces the request to use POST
  3. The attacker's page cannot read the token out of the victim's session and cannot guess it
  4. It encrypts the request body
Show the answer

Answer: C. The attacker's page cannot read the token out of the victim's session and cannot guess it

Same-origin policy prevents the attacker's page from reading the token, so it cannot construct a valid request.

Source: OWASP Cross-Site Request Forgery Prevention Cheat Sheet (OWASP) — OWASP CSRF Prevention Cheat Sheet › Token-Based Mitigation

Challenge yourself on this topic → Study as cards