CEH Web Application and Injection Attacks Practice Question

Which TWO of the following are effective mitigations against Cross-Site Request Forgery (CSRF)?

⚠ Common exam trap

EC-Council often tests the distinction between CSRF and XSS mitigations, and the trap here is that candidates confuse HTTPOnly cookies (which protect against XSS) as a CSRF defense, or they think that input validation or redundant token naming (anti-CSRF vs CSRF) are separate valid options.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Using SameSite cookies

SameSite cookies (option A) are effective against CSRF because they restrict the browser from sending cookies on cross-origin requests, preventing forged requests from carrying authentication credentials. CSRF tokens (option E) are also effective because they require a unique token in each request that the attacker cannot predict. Option C (anti-CSRF tokens) is essentially the same technique as option E, so it is not considered a distinct mitigation; thus, only options A and E are correct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Using SameSite cookies
Why this is correct
SameSite cookies are an effective mitigation because they instruct the browser to restrict when cookies are sent with cross-origin requests. By setting `SameSite=Lax` or `SameSite=Strict`, the browser will not attach session cookies to requests initiated from a different site, thereby preventing an attacker's forged request from carrying the necessary authentication credentials to execute an unauthorized action.
✗
Input validation
Why it's wrong here
Input validation is not an effective mitigation against CSRF because CSRF attacks do not rely on malicious or malformed input data. Instead, CSRF exploits the trust a web application places in a user's browser to perform legitimate actions, even if those actions are initiated by an attacker. The attack's success hinges on the browser automatically sending valid session cookies with a forged request for an otherwise legitimate operation, making input data integrity irrelevant.
✗
Using anti-CSRF tokens
Why it's wrong here
"Using anti-CSRF tokens" is functionally synonymous with "Using CSRF tokens." While CSRF tokens are indeed an effective mitigation, presenting "anti-CSRF tokens" as a separate, distinct answer option creates redundancy. The term simply emphasizes the protective nature of CSRF tokens, which are unique, unpredictable values embedded in requests to verify their legitimate origin.
✗
Using HTTPOnly cookies
Why it's wrong here
HTTPOnly cookies are primarily designed to mitigate Cross-Site Scripting (XSS) attacks by preventing client-side scripts from accessing cookie data. However, they do not prevent CSRF attacks because CSRF exploits the browser's automatic inclusion of cookies in requests to a site where the user is authenticated, regardless of whether a script can read those cookies. The attack does not rely on cookie theft, but on the browser's implicit trust.
✓
Using CSRF tokens
Why this is correct
CSRF tokens are a robust mitigation strategy that involves embedding a unique, unpredictable, and user-specific token within each state-changing request. The server generates this token and validates it upon submission, ensuring that the request originated from the legitimate application session and not from an attacker's forged request. An attacker cannot successfully forge a request without knowing this secret token.

Go deeper

CEH Web Application and Injection Attacks Practice Question

Why each option matters

Option-by-option breakdown

Related to this question