Certified Cloud Security Professional (CCSP)Cloud Application SecurityHard
A cloud-native application utilizes a RESTful API for all communications between its front-end and back-end services. A security audit has identified the potential for Cross-Site Request Forgery (CSRF) attacks as a significant risk. Which of the following is the most effective mitigation technique against CSRF for this API?
- AEnforcing HTTPS/TLS for all API communication channels.
- BImplementing strict Content Security Policy (CSP) headers on all API responses.
- CUtilizing JSON Web Tokens (JWTs) for authentication and session management.
- DRequiring all state-changing API requests to include an anti-CSRF token.
Show answer & explanationAnswer & explanation
Correct answer: D. Requiring all state-changing API requests to include an anti-CSRF token.
Anti-CSRF tokens, typically synchronized with the user's session, validate that the request originated from the legitimate application and not from an attacker's site, making them the most effective direct mitigation for CSRF.
Why the other options are wrong
- A. HTTPS/TLS encrypts data in transit but does not prevent a malicious site from forging a request that a legitimate, authenticated user's browser will send.
- B. CSP helps mitigate Cross-Site Scripting (XSS) and other content injection attacks but is not a direct defense against CSRF.
- C. JWTs are primarily for authentication and authorization. While they can be stateless, they don't inherently protect against CSRF if they are sent automatically by the browser (e.g., in a cookie) with a forged request.
Cross-Site Request Forgery (CSRF)
An attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated.
- Exploits trust in a user's browser.
- Targets state-changing requests.
- Mitigated by anti-CSRF tokens.
Memory trick: CSRF: 'Don't Get Phished', use a 'Token Shield'.