also known as a one-click attack or session riding, is an attack in which the attacker exploits the victim's active session with a trusted site to perform malicious activities such as item purchases and the modification or retrieval of account information.

also known as a one-click attack or session riding, is an attack in which the attacker exploits the victim's active session with a trusted site to perform malicious activities such as item purchases and the modification or retrieval of account information.

• A. CSRF Attack
• B. Session Fixation Attack
• C. Blind Hijacking
• D. Spoofing Attack

Answer: (A)

Cross-Site Request Forgery (CSRF) works by exploiting an active session a user has with a trusted site. The attacker tricks the user into visiting a malicious page that quietly causes the user’s browser to send a request to the trusted site. Because the user is already authenticated, the browser automatically includes the user’s session cookie with that request, so the trusted site treats it as a legitimate action performed by the user. No credentials the attacker needs; they piggyback on the existing session to carry out actions like making a purchase or changing account information. This is why the attack is often described as session riding. To defend against CSRF, applications should require tokens that are tied to the user’s session and included in sensitive requests, use SameSite cookies to prevent cross-site requests, validate the Referer or Origin headers, and sometimes require explicit user interactions or re-authentication for critical operations.

Cross-Site Request Forgery (CSRF) works by exploiting an active session a user has with a trusted site. The attacker tricks the user into visiting a malicious page that quietly causes the user’s browser to send a request to the trusted site. Because the user is already authenticated, the browser automatically includes the user’s session cookie with that request, so the trusted site treats it as a legitimate action performed by the user. No credentials the attacker needs; they piggyback on the existing session to carry out actions like making a purchase or changing account information. This is why the attack is often described as session riding.

To defend against CSRF, applications should require tokens that are tied to the user’s session and included in sensitive requests, use SameSite cookies to prevent cross-site requests, validate the Referer or Origin headers, and sometimes require explicit user interactions or re-authentication for critical operations.