Cross-site request forgery (CSRF) in Cybersecurity - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to identify the type of attack described.

Cybersecurity

An attack where unauthorized commands are transmitted from a user that the web application trusts is called [1].

Drag options to blanks, or click blank then click option'

ACross-site request forgery

BSQL Injection

CPhishing

DDenial of Service

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing CSRF with SQL Injection.

Thinking it is a phishing attack.

Cross-site request forgery (CSRF) tricks a user into submitting unwanted actions on a web application where they are authenticated.

2fill in blank

medium

Complete the code to describe a common defense against CSRF.

Cybersecurity

A common defense against CSRF attacks is to use a [1] token that is unique to each user session.

Drag options to blanks, or click blank then click option'

Acaptcha

Bpassword

CCSRF

Dsession

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'password' instead of the correct token.

Confusing CSRF token with captcha.

A CSRF token is a secret, unique value sent with requests to verify the request is legitimate.

3fill in blank

hard

Fix the error in the description of CSRF protection.

Cybersecurity

To protect against CSRF, the server should check if the request includes a valid [1] token matching the user's session.

Drag options to blanks, or click blank then click option'

AIP address

BCSRF

Cpassword

Dcookie

Attempts:

3 left

💡 Hint

Common Mistakes

Checking only cookies or IP addresses.

Using password instead of CSRF token.

The server verifies the CSRF token to ensure the request is from the legitimate user.

4fill in blank

hard

Fill both blanks to complete the explanation of how CSRF tokens work.

Cybersecurity

The server generates a [1] token and includes it in the [2] form to verify legitimate requests.

Drag options to blanks, or click blank then click option'

ACSRF

Bhidden

Cpassword

Dvisible

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'password' instead of CSRF for the token.

Placing the token in a visible form field.

The CSRF token is a secret value included as a hidden field in forms to validate requests.

5fill in blank

hard

Fill all three blanks to complete the code snippet that checks CSRF token validity.

Cybersecurity

if request.method == 'POST' and request.form.get('[1]') == session.get('[2]'):
    process_request()
else:
    raise [3]('Invalid CSRF token')

Drag options to blanks, or click blank then click option'

Acsrf_token

CSecurityError

DValueError

Attempts:

3 left

💡 Hint

Common Mistakes

Using different token names in form and session.

Raising a generic error instead of a security-specific one.

The code compares the CSRF token from the form with the one stored in the session. If they don't match, it raises a security error.