Study. uk . com
  1. Home
  2. All questions
  3. Question 582

CompTIA Security+ study material · question 582 of 611

A team adds CSRF tokens to every endpoint, including read-only ones. What is the effect?

  1. Stronger protection against session hijacking
  2. Reduced exposure to insecure direct object references
  3. Effort spent without reducing risk, since only state-changing requests need the token
  4. Protection against cross-site scripting
Show the answer

Answer: C. Effort spent without reducing risk, since only state-changing requests need the token

Forging a read has no effect the attacker can observe, so the token adds nothing there.

Source: OWASP Cross-Site Request Forgery Prevention Cheat Sheet (OWASP) — OWASP CSRF Prevention Cheat Sheet › Token-Based Mitigation

Challenge yourself on this topic → Study as cards