Multiple Choice Questions on CSRF Protection and SameSite Cookies

📚 Quick Study Guide

• 🛡️ CSRF (Cross-Site Request Forgery): An attack where a malicious website causes a user's web browser to perform an unwanted action on a trusted site where the user is authenticated.
• 🔑 CSRF Protection Techniques:
  • 🏷️ Synchronizer Token Pattern: Embed a unique, unpredictable token in forms and verify it on the server-side.
  • 🍪 Double Submit Cookie: Set a cookie with a random value and include the same value as a hidden field in the form. Verify that both match on the server-side.
  • 🌐 SameSite Cookie Attribute: A cookie attribute that controls whether a cookie is sent with cross-site requests.
• 🍪 SameSite Cookie Attributes:
  • ✅ Strict: The cookie is only sent with requests originating from the same site. Provides the strongest CSRF protection.
  • ⚠️ Lax: The cookie is sent with same-site requests and top-level navigation (GET) requests. A reasonable default for many applications.
  • 🚫 None: The cookie is sent with all requests, both same-site and cross-site. Requires the `Secure` attribute (HTTPS).
• 🔒 Importance of HTTPS: SameSite=None requires the Secure attribute, meaning the cookie must only be transmitted over HTTPS.

Practice Quiz

1. Which of the following best describes a Cross-Site Request Forgery (CSRF) attack?
   1. A) An attacker gains unauthorized access to a server by exploiting vulnerabilities in the operating system.
   2. B) An attacker tricks a user into executing unwanted actions on a website where they are authenticated.
   3. C) An attacker intercepts and modifies data transmitted between a client and a server.
   4. D) An attacker floods a server with requests, causing it to become unavailable.
2. What is the primary purpose of the Synchronizer Token Pattern in CSRF protection?
   1. A) To encrypt sensitive data transmitted between the client and the server.
   2. B) To verify that the user's session is valid before processing any requests.
   3. C) To ensure that all requests originate from the legitimate user and not a malicious source.
   4. D) To prevent cross-site scripting (XSS) attacks.
3. In the context of CSRF protection, what does the Double Submit Cookie technique involve?
   1. A) Sending the user's password twice with each request.
   2. B) Setting a cookie with a random value and including the same value as a hidden field in the form.
   3. C) Requiring the user to solve a CAPTCHA before submitting a form.
   4. D) Verifying the user's email address before processing any requests.
4. What does the `SameSite` cookie attribute control?
   1. A) The expiration date of the cookie.
   2. B) Whether the cookie is sent with cross-site requests.
   3. C) The size of the cookie.
   4. D) The domain to which the cookie belongs.
5. Which `SameSite` attribute provides the strongest CSRF protection?
   1. A) Lax
   2. B) Strict
   3. C) None
   4. D) Default
6. When is the `SameSite=None` attribute required for cookies?
   1. A) When the cookie is used for authentication purposes.
   2. B) When the cookie is sent with same-site requests.
   3. C) When the cookie is sent with cross-site requests and must work in older browsers.
   4. D) When the cookie is used to store sensitive information.
7. Which of the following is a requirement when using `SameSite=None`?
   1. A) The `HttpOnly` attribute must also be set.
   2. B) The `Secure` attribute must also be set.
   3. C) The cookie must be encrypted.
   4. D) The cookie must be signed.