Web Security · Junior · Question 35 of 75

Which attack does a CSRF token NOT protect against?

1A hidden <img> that calls an action URL
2A form auto-submitted from another domain
✓Correct answer: XSS on the same site, because the injected script can read the token from the page

Explanation

Code running on your own origin can read your pages and tokens. XSS defeats CSRF defenses, so both have to be fixed.

Further reading

Test yourself

Take the Web Security · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.