Which vulnerability forces a user's browser to perform an authenticated request to a server without the user's intent?

Which vulnerability forces a user's browser to perform an authenticated request to a server without the user's intent?

• A. Cross-site request forgery
• B. Cross-site scripting
• C. SQL Injection
• D. Clickjacking

Answer: (A)

Cross-Site Request Forgery happens when a user who is already authenticated to a site is tricked into making a request to that site without intending to. The browser automatically sends the user’s session cookies with the request, so the server treats it as a legitimate action by the logged-in user. An attacker can cause the user’s browser to perform state-changing operations by luring them to a malicious page or by loading a crafted image or form that issues the request behind the scenes. The critical point is that the request is forged by the browser using the existing session, not by the attacker stealing credentials or the user manually performing the action. This best fits the scenario because it specifically describes a forged request that exploits an active login to perform actions without the user’s consent. Other options don’t match as precisely: cross-site scripting involves injecting and executing script in the victim’s browser to grab data or take control of the page; SQL injection targets the server by manipulating database queries through user input; clickjacking tricks the user into clicking something, but it relies on the user taking an action rather than the browser automatically making an authenticated request.

Cross-Site Request Forgery happens when a user who is already authenticated to a site is tricked into making a request to that site without intending to. The browser automatically sends the user’s session cookies with the request, so the server treats it as a legitimate action by the logged-in user. An attacker can cause the user’s browser to perform state-changing operations by luring them to a malicious page or by loading a crafted image or form that issues the request behind the scenes. The critical point is that the request is forged by the browser using the existing session, not by the attacker stealing credentials or the user manually performing the action.

This best fits the scenario because it specifically describes a forged request that exploits an active login to perform actions without the user’s consent. Other options don’t match as precisely: cross-site scripting involves injecting and executing script in the victim’s browser to grab data or take control of the page; SQL injection targets the server by manipulating database queries through user input; clickjacking tricks the user into clicking something, but it relies on the user taking an action rather than the browser automatically making an authenticated request.