Lesson test: Defending against CSRF and XSS

Sign in

Libre University uses your GitHub account. Signing in is only needed to sit a final test, so the score is kept on your profile.

Defending against CSRF and XSS

1.[3p]
The same-origin policy is in force and a page on `evil.com` posts a form to `bank.com`. Why does the request still succeed?

The policy governs reading responses, not sending requests, and the cookie is attached by destination

Correct

The policy only applies to subdomains of the same registrable domain

The answer is: The policy governs reading responses, not sending requests, and the cookie is attached by destination

Form posts are exempt because they predate the policy

The answer is: The policy governs reading responses, not sending requests, and the cookie is attached by destination

The policy is disabled whenever CORS headers are present

The answer is: The policy governs reading responses, not sending requests, and the cookie is attached by destination

2.[3p]
Which cross-site requests reach the server with no CORS preflight, so the cookie is attached?

Select all that apply

A GET triggered by an img tag

Correct

A POST with Content-Type: application/x-www-form-urlencoded

Correct

A POST with Content-Type: text/plain

Correct

A POST with Content-Type: application/json

The answer is: A GET triggered by an `img` tag, A POST with `Content-Type: application/x-www-form-urlencoded`, A POST with `Content-Type: text/plain`

3.[3p]
A site sets `SameSite=Lax` and has `GET /account/delete?confirm=yes`. Is it protected?

No, because Lax still attaches the cookie to top-level navigation with a safe method

Correct

Yes, because Lax withholds the cookie on every cross-site request

The answer is: No, because Lax still attaches the cookie to top-level navigation with a safe method

Yes, provided the endpoint also checks the Referer header

The answer is: No, because Lax still attaches the cookie to top-level navigation with a safe method

No, but only in browsers older than Chrome 80

The answer is: No, because Lax still attaches the cookie to top-level navigation with a safe method

4.[3p]
Naive double submit is broken by an attacker who controls any subdomain. What do they do?

Set the CSRF cookie for the parent domain, then submit a form carrying the same chosen value

Correct

Read the CSRF cookie and copy it into their own form

The answer is: Set the CSRF cookie for the parent domain, then submit a form carrying the same chosen value

Strip the CSRF cookie so the check is skipped

The answer is: Set the CSRF cookie for the parent domain, then submit a form carrying the same chosen value

Replay the victim's session token from a different origin

The answer is: Set the CSRF cookie for the parent domain, then submit a form carrying the same chosen value

5.[3p]
Match each kind of cross-site scripting to where the payload comes from.

Reflected
Stored
DOM-based

read from the URL by page script and written into the document
echoed straight back in the response to the request that carried it
saved in the database and served to every later visitor

Show the answer

Reflected: echoed straight back in the response to the request that carried it Stored: saved in the database and served to every later visitor DOM-based: read from the URL by page script and written into the document

6.[2p]
`HttpOnly` prevents an attacker with cross-site scripting on your origin from acting as the logged-in user.

True

The answer is: False

False

Correct

7.[3p]
Why is sanitising input on the way into the database the wrong layer?

The correct escaping depends on the context it will be rendered into, which is unknown at input time

Correct

Databases reject escaped characters

The answer is: The correct escaping depends on the context it will be rendered into, which is unknown at input time

It is slower than escaping at render time

The answer is: The correct escaping depends on the context it will be rendered into, which is unknown at input time

It only handles reflected XSS and not stored XSS

The answer is: The correct escaping depends on the context it will be rendered into, which is unknown at input time

8.[3p]
Which of these belong in a modern Content Security Policy?

Select all that apply

A fresh per-response nonce of at least 128 bits on every legitimate script tag

Correct

'strict-dynamic', so a nonced script may load the scripts it trusts

Correct

base-uri 'none', so an injected base tag cannot redirect relative script URLs

Correct

An allowlist of trusted CDN hostnames instead of a nonce

The answer is: A fresh per-response nonce of at least 128 bits on every legitimate script tag, `'strict-dynamic'`, so a nonced script may load the scripts it trusts, `base-uri 'none'`, so an injected base tag cannot redirect relative script URLs

9.[2p]
Which request header, set by the browser and unforgeable by script, is the cheapest second layer against CSRF?

CorrectNot quite: Origin

1.[3p] The same-origin policy is in force and a page on evil.com posts a form to bank.com. Why does the request still succeed?

2.[3p] Which cross-site requests reach the server with no CORS preflight, so the cookie is attached?

3.[3p] A site sets SameSite=Lax and has GET /account/delete?confirm=yes. Is it protected?

4.[3p] Naive double submit is broken by an attacker who controls any subdomain. What do they do?

5.[3p] Match each kind of cross-site scripting to where the payload comes from.

6.[2p] HttpOnly prevents an attacker with cross-site scripting on your origin from acting as the logged-in user.

7.[3p] Why is sanitising input on the way into the database the wrong layer?

8.[3p] Which of these belong in a modern Content Security Policy?

9.[2p] Which request header, set by the browser and unforgeable by script, is the cheapest second layer against CSRF?

1.[3p]
The same-origin policy is in force and a page on `evil.com` posts a form to `bank.com`. Why does the request still succeed?

2.[3p]
Which cross-site requests reach the server with no CORS preflight, so the cookie is attached?

3.[3p]
A site sets `SameSite=Lax` and has `GET /account/delete?confirm=yes`. Is it protected?

4.[3p]
Naive double submit is broken by an attacker who controls any subdomain. What do they do?

5.[3p]
Match each kind of cross-site scripting to where the payload comes from.

6.[2p]
`HttpOnly` prevents an attacker with cross-site scripting on your origin from acting as the logged-in user.

7.[3p]
Why is sanitising input on the way into the database the wrong layer?

8.[3p]
Which of these belong in a modern Content Security Policy?

9.[2p]
Which request header, set by the browser and unforgeable by script, is the cheapest second layer against CSRF?