What is CSRF token and its purpose?

• A. A token used to encrypt the entire web session.
• B. A token that avoids user authentication.
• C. A token that approves network connections.
• D. A token validated on state-changing requests to prevent cross-site request forgery.

Answer: (D)

CSRF tokens are secret values tied to a user session that must accompany requests that change state on a web application. Their purpose is to prevent cross-site request forgery. When a page is loaded, the server issues a token and embeds it in the page (as a hidden form field or a header). When a state-changing action is performed, the client sends the token back, and the server verifies that it matches the token issued for that session before executing the action. This stops a malicious site from tricking a logged-in user into performing unwanted actions, because the attacker cannot obtain the correct token due to the same-origin policy. It’s not about encrypting the whole session, bypassing authentication, or approving network connections.