$4.$ Web Security $[8$ Points$]$

Cross$-$Site Request Forgery $($CSRF$)()$

In a CSRF attack, a malicious user is able to take action on behalf of the victim. Consider

the following example. Mallory posts the following in a comment on a chat forum:

Of course, Patsy$-$Bank won$$t let just anyone request a transaction on behalf of any

given account name. Users first need to authenticate with a password. However, once a

user has authenticated, Patsy$-$Bank associates their session ID with an authenticated

session state.

$($a$)[4$ Points$]$ Explain what could happen when Alice visits the chat forum and views

Mallory$$s comment.

$($b$)[4$ Points$]$ Patsy$-$Bank decides to check that the Referer header contains patsy$-$

bank.com. Will the attack above work? Why or why not?