🛡️ Free practice test question from: CSRF mitigation (Security+)

A) While the double-submit cookie pattern doesn't require server-side state, ensuring tokens can't be forged involves complexity. Attackers might exploit vulnerabilities if tokens are predictable or not securely signed.

B) The synchronizer token pattern requires the server to store tokens for each user session, which contradicts the requirement of not storing additional state. But it is a traditional approach used in many web frameworks.

C) Setting SameSite=Strict is a defense-in-depth measure but might degrade user experience (e.g., issues with legitimate cross-site requests) and doesn't provide as robust protection as custom headers in this context

Explanation of Option D: When a request is made from a different origin, browsers prevent custom headers from being set due to Same-Origin policy. This means an attacker cannot forge a request with the required secret header, effectively blocking CSRF attacks. The custom header approach provides a robust, modern solution to CSRF protection that aligns perfectly with the application's architecture and security needs.