DeepFrontend
Learning Paths
Practice
System Design & DS
Design Studio
Data Structures Curriculum
Real-World Case Studies
Careers
Job Board
Resume Builder
Blog
Sign in
Search
⌘K
Go Pro
Loading compiler resources...
Web Security Quiz Practice
Active Recall Drill Session
← Exit Session
Question 1 of 1
medium
Web Security
A code review finds a password-change endpoint that only checks for a valid session cookie, with no CSRF token and no SameSite attribute set on that cookie. What's the risk?
A
No risk — session cookie presence is sufficient proof of intent
B
An attacker's page can auto-submit a cross-origin form to this endpoint; the browser attaches the valid session cookie automatically, and the server has no way to tell the request wasn't user-initiated
C
This only matters if the cookie is httpOnly
D
This is exclusively an XSS risk, not CSRF
Check Answer