How do XSS and CSRF differ, and what controls address each?
Interactive Practice Mode
Formulate your thoughts or take notes before revealing the model solution.
Saved automatically
Model Answer & Deep-Dive Explanation
Cross-site scripting runs attacker-controlled script in a trusted application’s browser context, often through unsafe rendering. Use context-appropriate output encoding, safe DOM APIs, sanitization for permitted rich HTML, and a restrictive content security policy as defense in depth. Cross-site request forgery causes a victim’s browser to send an unwanted authenticated request. Use anti-CSRF tokens where applicable, suitable SameSite cookies, and origin checks. HttpOnly helps protect cookies from script access but does not stop all XSS effects. CORS alone is not a complete CSRF defense.
Related Questions in Cybersecurity & InfoSec
Explain SQL Injection (SQLi) vulnerabilities and defense mechanisms (Prepared Statements vs ORM)
Intermediate level • 1252 views
How do authentication, authorization, and accounting differ?
Easy level • 1 views
Why do parameterized queries prevent SQL injection more reliably than escaping user input?
Medium level • 1 views
What is least privilege, and how would you apply it to a database-backed application?
Easy level • 1 views
A user changes an invoice ID in the URL and sees another customer’s invoice. What failed?
Medium level • 1 views