A review of purchases made at an online retailer shows that several orders were processed for items at an unpublished price. Which protection can a Citrix Engineer implement to prevent a site visitor from modifying the unit price of a product on the shopping cart page?

The Form Field Consistency protection is designed to prevent tampering with web forms. When a form is sent to a user, the Citrix Web App Firewall (WAF) stores the structure and properties of its fields, including hidden or read-only fields like price. Upon submission, the WAF verifies that the returned form data matches the original structure and that fields intended to be static have not been modified. This directly prevents a user from altering a product's price in the form before submitting the order.

A. Cross-Site Request Forgeries (CSRF) protection prevents an attacker from tricking a logged-in user's browser into sending an unauthorized request to a different site.
C. HTML Cross-Site Scripting (XSS) protection prevents attackers from injecting malicious client-side scripts into web pages viewed by other users.
D. HTML SQL Injection protection prevents attackers from manipulating form inputs to alter backend database queries, not from modifying the form field values themselves.

1. Citrix Product Documentation. (2023). Form Field Consistency Check. Citrix ADC 13.1. Retrieved from docs.citrix.com. It states, "The Form Field Consistency check examines the web forms returned by users to your websites and verifies that they were not modified inappropriately before being returned... It is especially useful for protecting forms that contain hidden fields, because a user can easily manipulate a hidden field and send a modified value."

2. Citrix Product Documentation. (2023). Web App Firewall Protections. Citrix ADC 13.1. Retrieved from docs.citrix.com. This document outlines the purpose of each protection, clearly distinguishing Form Field Consistency from CSRF, XSS, and SQL Injection checks.