A cookie-authenticated civic admin form accepts POST from the browser. Attackers could trick a logged-in clerk’s browser into submitting a cross-origin POST. Which mitigation specifically addresses CSRF?
Select an answer to reveal the explanation.
Short Explanation
Being logged in is not the same as meaning to press that button—CSRF needs a token (or a strict SameSite policy) on state-changing posts, not just “session exists.”
Full Explanation
CSRF mitigation requires that state-changing requests carry an anti-CSRF token or an equivalent control such as SameSite=strict cookies named in the design. Checking only that the user is authenticated allows cross-site POSTs from another origin. Output encoding and SQL parameterization address XSS and SQLi, not forged cross-site form posts.