Security · Question 2 of 12
What is Cross-Site Request Forgery (CSRF)?
1 answer is correct. Easy
Show answer
Answer
- D A foreign website makes the browser of a logged-in user perform an action unintentionally
Explanation
With CSRF, the attacker exploits the fact that the browser sends cookies automatically: if an editor is logged in to the backend and opens a prepared page, that page can, for example, submit a hidden form to TYPO3 with the editor's permissions. Protection comes from secret tokens bound to the session and checked on every state-changing request; TYPO3 does this in the backend with its FormProtection. The cookie attribute SameSite helps as well. The description with injected JavaScript is the most common mix-up: that is XSS, where foreign code is executed in the browser.