CS Fundamentals Trainer · JavaScript · Security

Put the steps of a classic CSRF attack in order, first to last.

  1. The bank's server sees a valid session and performs the transfer
  2. The browser attaches the bank's cookie to that request, as far as SameSite rules allow
  3. The evil page auto-submits a hidden form to `https://bank.example/transfer`
  4. The victim logs in to `bank.example`, which sets a session cookie
  5. The victim opens a page on `evil.example` in another tab

Difficulty: easy

Answer this question

Related questions