Xss

Overview CSRF and XSS are both web attacks that abuse a victim’s trusted relationship with a site, but they exploit opposite ends of that trust. CSRF forges a request using the victim’s own session cookie without ever running attacker code in the browser, while XSS smuggles injected script into a vulnerable page so it executes directly inside the victim’s browser. Comparison Diagram CSRFXSSVictim Browseractive session cookieAttacker Siteforged auto-submit formTarget Servere.g. bank / app backendAction Executedusing victim's cookievisits pagecookie auto-attachedno injected codeVulnerable Siterenders unsanitized inputInjected <script>runs in page's own originVictim Browserexecutes attacker JSAttacker Serverreceives stolen datainput reflected as codefull DOM accesscookie exfiltrated Comparison Table Aspect CSRF XSS Attack vector Forged cross-site request, e.g. an auto-submitting form or image tag on the attacker’s page that targets the victim site Malicious script injected into a vulnerable page’s HTML or JS output, often via unsanitized user input Trust exploited Server’s trust that any request carrying a valid session cookie came from the legitimate user Browser’s trust that all script served from the site’s origin is safe to execute Where the payload runs Nowhere on the victim’s browser beyond a normal HTTP request; the ‘payload’ is the request itself Attacker’s JavaScript executes directly inside the victim’s browser, in the vulnerable site’s own origin Prerequisite for success Victim must have an active authenticated session with the target site when the forged request fires Vulnerable site must reflect, store, or render attacker-controlled input without proper sanitization or escaping Attacker capability Limited to whatever action the victim’s existing session is authorized to perform, like a transfer or settings change Broad: read cookies and localStorage, capture input, deface the page, or pivot into session hijacking Primary defense Anti-CSRF tokens, SameSite cookies, and origin or referer checks Output encoding, Content Security Policy, and strict input sanitization Typical impact scope A single forged action, bounded by what the target endpoint allows Potential full account takeover or persistent compromise if the injection is stored Key Differences CSRF forges a request using the victim’s existing session cookie; XSS injects attacker script that runs inside the victim’s browser. CSRF requires no code injection into the target site, while XSS depends entirely on unsanitized input reaching the page. XSS can read and exfiltrate data straight from the DOM, whereas CSRF is limited to blind requests with no response visibility. SameSite cookies mitigate CSRF but do nothing against XSS, which is stopped primarily by CSP and output encoding. When to Use Each CSRF ...