Web Security · Middle · Question 29 of 75
An app authenticates API calls with an Authorization: Bearer header taken from memory, not cookies. Is CSRF a concern?
- ✓Correct answer: Much less: the browser doesn't attach the header automatically, so another site can't send it
- 2Yes, even more than with cookies
- 3Yes, because bearer tokens are sent with every image request
Explanation
CSRF needs ambient credentials. The trade-off is that the token is reachable by JavaScript, so XSS becomes the bigger risk.