CSRF is addressed by coding techniques that ensure applications do not rely on auth credentials and tokens automatically submitted by browsers. Which approach aligns with this guidance?

• A. Relying on credentials and tokens automatically submitted by browsers
• B. Storing tokens in cookies without HttpOnly
• C. Not relying on auth credentials and tokens automatically submitted by browsers
• D. Requiring re-authentication on every request

Answer: (C)

The idea is to prevent the browser from automatically supplying credentials in a way that a malicious site could exploit. CSRF happens because the browser will include cookies (and any session-auth data) with requests to your site, even if the user didn’t deliberately intend to perform that action. The safe approach is to design requests so they do not rely on those auto-submitted credentials, and instead require a value that the attacker cannot forge from another site—such as a CSRF token that the client must send in the request (for example in a form field or a custom header) and that the server validates for the user session. This way, a cross-site request cannot succeed without access to that token.

Choices that rely on credentials automatically submitted by browsers are vulnerable, and storing tokens in cookies could still be sent automatically if not protected, while re-authentication on every request is impractical and does not address the underlying risk. Therefore, not relying on auth credentials and tokens automatically submitted by browsers aligns with the CSRF protection guidance.