What countermeasure is described for mitigating a cross-site request forgery attack?

What countermeasure is described for mitigating a cross-site request forgery attack?

• A. Log all user activity for auditing
• B. Use multi-factor authentication for all sessions
• C. Limit login attempts to prevent brute force
• D. Log off immediately after using a web application. Clear the history after using a web application, and don’t allow your browser to save your login details.

Answer: (D)

Cross-site request forgery relies on the browser sending the victim’s authenticated session with a forged request. If you’re still logged in and the browser holds your session cookies or credentials, a malicious site can trick the browser into performing actions on the trusted site as you. Ending the session immediately after use and not saving login details directly reduces that risk. When you log off, there’s no active authenticated session for a forged request to exploit. Clearing history and avoiding saved credentials further limit what a attacker could leverage, since the browser won’t automatically send valid session information or auto-fill sensitive actions. Other measures like logging activity, requiring multi-factor authentication for logins, or limiting login attempts address different security concerns (auditability, authentication strength, and brute-force protection) and don’t specifically prevent a forged request once an authenticated session exists. So, ending the session and not retaining credentials is the most effective on-the-fly mitigation among the options.

Cross-site request forgery relies on the browser sending the victim’s authenticated session with a forged request. If you’re still logged in and the browser holds your session cookies or credentials, a malicious site can trick the browser into performing actions on the trusted site as you.

Ending the session immediately after use and not saving login details directly reduces that risk. When you log off, there’s no active authenticated session for a forged request to exploit. Clearing history and avoiding saved credentials further limit what a attacker could leverage, since the browser won’t automatically send valid session information or auto-fill sensitive actions.

Other measures like logging activity, requiring multi-factor authentication for logins, or limiting login attempts address different security concerns (auditability, authentication strength, and brute-force protection) and don’t specifically prevent a forged request once an authenticated session exists. So, ending the session and not retaining credentials is the most effective on-the-fly mitigation among the options.