hard20 pts · first answer countsweb-securitycsrf

CSRF risk left with SameSite=Lax

Your session cookie is set with SameSite=Lax. Which request from a page on evil.example is still a CSRF risk?

A.A hidden form on evil.example that POSTs to your /transfer endpointB.A link to your GET /account/delete?confirm=1 endpoint, opened as a top-level navigationC.A fetch() from evil.example to your /api/profile with credentials: includeD.An <img> tag on evil.example pointing at your /logout URL

Discussion 0

Join free to post in the discussion.

CSRF risk left with SameSite=Lax

Discussion 0

Related questions