What is CSRF protection in Spring Security?
A) A security feature that prevents cross-site request forgery attacks
B) A mechanism to secure database transactions
C) A tool to encrypt user passwords
D) A method to manage user sessions
Answer:
A) A security feature that prevents cross-site request forgery attacks
Explanation:
CSRF (Cross-Site Request Forgery) protection is a security feature in Spring Security that prevents malicious websites from making unauthorized requests on behalf of a user. CSRF attacks occur when an attacker tricks a user into performing actions on a different website where they are authenticated, such as submitting a form or making a request without their knowledge.
Spring Security’s CSRF protection works by requiring a unique token to be included with each state-changing request (e.g., POST, PUT, DELETE). This token must be validated by the server to ensure that the request is legitimate. If the token is missing or invalid, the server rejects the request, thereby protecting against CSRF attacks.