CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  HttpOnly flag

  Why it's wrong here

  The HttpOnly flag prevents client-side scripts, such as JavaScript, from accessing the cookie. While crucial for mitigating Cross-Site Scripting (XSS) attacks by preventing cookie theft, it does not prevent a browser from automatically attaching the cookie to a cross-site request initiated by a malicious site. Therefore, it offers no direct protection against Cross-Site Request Forgery (CSRF), as CSRF exploits the browser's default behavior of sending cookies with requests.

• ✓

  SameSite=Strict

  Why this is correct

  The SameSite=Strict attribute is a powerful defense against CSRF attacks by instructing the browser to only send the cookie with requests originating from the same site as the cookie's domain. This means if a user is logged into `example.com` and then visits `malicious.com`, any requests `malicious.com` attempts to make back to `example.com` will not include the session cookie. Consequently, the malicious request will not be authenticated, effectively preventing the forgery.

• ✗

  Domain attribute

  Why it's wrong here

  The Domain attribute specifies which hosts are permitted to receive the cookie, defining its scope to a particular domain or its subdomains. For instance, setting `Domain=example.com` allows `sub.example.com` to receive the cookie. However, this attribute does not dictate whether a cookie should be sent with a cross-site request, only where it can be sent. Thus, it provides no inherent protection against CSRF attacks.

• ✗

  Secure flag

  Why it's wrong here

  The Secure flag ensures that a cookie is only transmitted over encrypted HTTPS connections, protecting it from interception by passive network attackers. While vital for preventing man-in-the-middle attacks and ensuring confidentiality, it does not prevent the browser from sending the cookie in a cross-site request if that request is also made over HTTPS. Therefore, it does not mitigate the core mechanism of CSRF, which relies on an authenticated user's browser making an unintended request.

Go deeper

Related to this question