Web Security · Junior · Question 29 of 75
Why is CSRF possible with cookie-based sessions?
- ✓Correct answer: Browsers used to attach cookies to requests to a site no matter which site started the request
- 2Because cookies are sent in plain text
- 3Because cookies can be read by any website
Explanation
Ambient credentials are the core of CSRF. The SameSite attribute was added to cookies to limit this behavior.