CS Fundamentals Trainer · JavaScript · Security

Why does requiring a custom request header such as X-CSRF-Token (checked by the server) stop a cross-site page from forging a fetch that…

Why does requiring a custom request header such as `X-CSRF-Token` (checked by the server) stop a cross-site page from forging a `fetch` that carries the victim's cookies?

  1. Browsers strip non-standard headers from cross-site requests before sending them, so the server's check fails.
  2. Custom headers are protected by TLS, while cookies travel unencrypted and are easy to replay.
  3. A custom header tells the browser to drop cookies, so the forged request arrives unauthenticated.
  4. A custom header makes the request non-simple, so the browser first sends a CORS preflight, which the server does not approve.

Difficulty: hard

Answer this question

Related questions