Defending against CSRF and XSS
1.[3p] The same-origin policy is in force and a page on evil.com posts a form to bank.com. Why does the request still succeed?
The same-origin policy is in force and a page on evil.com posts a form to bank.com. Why does the request still succeed?
The answer is: The policy governs reading responses, not sending requests, and the cookie is attached by destination
The answer is: The policy governs reading responses, not sending requests, and the cookie is attached by destination
The answer is: The policy governs reading responses, not sending requests, and the cookie is attached by destination
2.[3p] Which cross-site requests reach the server with no CORS preflight, so the cookie is attached?
Which cross-site requests reach the server with no CORS preflight, so the cookie is attached?
Select all that apply
The answer is: A GET triggered by an img tag, A POST with Content-Type: application/x-www-form-urlencoded, A POST with Content-Type: text/plain
3.[3p] A site sets SameSite=Lax and has GET /account/delete?confirm=yes. Is it protected?
A site sets SameSite=Lax and has GET /account/delete?confirm=yes. Is it protected?
The answer is: No, because Lax still attaches the cookie to top-level navigation with a safe method
The answer is: No, because Lax still attaches the cookie to top-level navigation with a safe method
The answer is: No, because Lax still attaches the cookie to top-level navigation with a safe method
4.[3p] Naive double submit is broken by an attacker who controls any subdomain. What do they do?
Naive double submit is broken by an attacker who controls any subdomain. What do they do?
The answer is: Set the CSRF cookie for the parent domain, then submit a form carrying the same chosen value
The answer is: Set the CSRF cookie for the parent domain, then submit a form carrying the same chosen value
The answer is: Set the CSRF cookie for the parent domain, then submit a form carrying the same chosen value
5.[3p] Match each kind of cross-site scripting to where the payload comes from.
Match each kind of cross-site scripting to where the payload comes from.
Reflected
Stored
DOM-based
read from the URL by page script and written into the document
echoed straight back in the response to the request that carried it
saved in the database and served to every later visitor
Show the answer
Reflected: echoed straight back in the response to the request that carried it Stored: saved in the database and served to every later visitor DOM-based: read from the URL by page script and written into the document
6.[2p] HttpOnly prevents an attacker with cross-site scripting on your origin from acting as the logged-in user.
HttpOnly prevents an attacker with cross-site scripting on your origin from acting as the logged-in user.
The answer is: False
7.[3p] Why is sanitising input on the way into the database the wrong layer?
Why is sanitising input on the way into the database the wrong layer?
The answer is: The correct escaping depends on the context it will be rendered into, which is unknown at input time
The answer is: The correct escaping depends on the context it will be rendered into, which is unknown at input time
The answer is: The correct escaping depends on the context it will be rendered into, which is unknown at input time
8.[3p] Which of these belong in a modern Content Security Policy?
Which of these belong in a modern Content Security Policy?
Select all that apply
The answer is: A fresh per-response nonce of at least 128 bits on every legitimate script tag, 'strict-dynamic', so a nonced script may load the scripts it trusts, base-uri 'none', so an injected base tag cannot redirect relative script URLs
9.[2p] Which request header, set by the browser and unforgeable by script, is the cheapest second layer against CSRF?
Which request header, set by the browser and unforgeable by script, is the cheapest second layer against CSRF?