Web Security · Junior · Question 30 of 75
What is a CSRF token?
- 1A token from the payment provider
- 2A cookie that stores the user's password
- ✓Correct answer: A random secret value the server puts in its forms and checks on submit, which other sites can't know
Explanation
A forged request from another site doesn't include the right token, so the server rejects it. The token must be unpredictable and tied to the session.