CSRF vs XSS: Forged Requests or Injected Scripts

Mon, 03 Aug 2026 04:27:16 +0900

Overview

CSRF and XSS are both web attacks that abuse a victim’s trusted relationship with a site, but they exploit opposite ends of that trust. CSRF forges a request using the victim’s own session cookie without ever running attacker code in the browser, while XSS smuggles injected script into a vulnerable page so it executes directly inside the victim’s browser.

Comparison Diagram

Comparison Table

Aspect	CSRF	XSS
Attack vector	Forged cross-site request, e.g. an auto-submitting form or image tag on the attacker’s page that targets the victim site	Malicious script injected into a vulnerable page’s HTML or JS output, often via unsanitized user input
Trust exploited	Server’s trust that any request carrying a valid session cookie came from the legitimate user	Browser’s trust that all script served from the site’s origin is safe to execute
Where the payload runs	Nowhere on the victim’s browser beyond a normal HTTP request; the ‘payload’ is the request itself	Attacker’s JavaScript executes directly inside the victim’s browser, in the vulnerable site’s own origin
Prerequisite for success	Victim must have an active authenticated session with the target site when the forged request fires	Vulnerable site must reflect, store, or render attacker-controlled input without proper sanitization or escaping
Attacker capability	Limited to whatever action the victim’s existing session is authorized to perform, like a transfer or settings change	Broad: read cookies and localStorage, capture input, deface the page, or pivot into session hijacking
Primary defense	Anti-CSRF tokens, SameSite cookies, and origin or referer checks	Output encoding, Content Security Policy, and strict input sanitization
Typical impact scope	A single forged action, bounded by what the target endpoint allows	Potential full account takeover or persistent compromise if the injection is stored

Key Differences

CSRF forges a request using the victim’s existing session cookie; XSS injects attacker script that runs inside the victim’s browser.
CSRF requires no code injection into the target site, while XSS depends entirely on unsanitized input reaching the page.
XSS can read and exfiltrate data straight from the DOM, whereas CSRF is limited to blind requests with no response visibility.
SameSite cookies mitigate CSRF but do nothing against XSS, which is stopped primarily by CSP and output encoding.

When to Use Each

CSRF

Csrf on IT Comparison

CSRF vs XSS: Forged Requests or Injected Scripts

Overview

Comparison Diagram

Comparison Table

Key Differences

When to Use Each