OWASP Vulnerabilities · interview question
How would you explain a potential limitation of using only CSRF tokens for preventing CSRF attacks in an interview?
Multiple choiceHardchapter-17-curatedpremiumowasp-vulnerabilitiescross-site-request-forgery-csrf
Answer and explanation
Correct answer
C. They do not protect against cross-site scripting (XSS)
Why
CSRF tokens do not protect against XSS. If an attacker can inject scripts into a page, they might steal CSRF tokens and perform actions on behalf of users.
Test yourself on OWASP Vulnerabilities
A free test with instant, explained results. No account needed.
More OWASP Vulnerabilities questions
- In a Spring Security filter chain, what is the purpose of filters?
- What role does the 'Signature' play in a JWT?
- Why does the 'signature' in a JWT matter in this design?
- How would you explain a key strategy Java web applications use to protect against Stored XSS attacks in an interview?
- Which of the following best describes a CSRF attack?
- How does Spring Security validate that a CSRF token is legitimate upon receiving a form submission?