Browser & Web Performance · Middle · Question 54 of 75

What is CSRF?

1A man-in-the-middle reads traffic on public Wi-Fi
✓Correct answer: Another site makes the user's browser send a state-changing request to your site with the user's cookies
3An attacker injects a script into your page

Explanation

Defenses: SameSite cookies, anti-CSRF tokens, checking Origin/Sec-Fetch-Site, and never changing state on GET.

Further reading

Test yourself

Take the Browser & Web Performance · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.