Web Security · Junior · Question 34 of 75

Does a CSRF attacker see the response to the forged request?

1Yes, but only for JSON responses
✓Correct answer: No: the browser sends it, but the same-origin policy stops the attacker's page from reading the result
3Yes, the response is always shown on the attacker's page

Explanation

CSRF is about side effects, not reading data. That's why it targets actions like changing an email, not fetching a profile.

Further reading

Test yourself

Take the Web Security · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.