thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Application & OT Security

XSS vs CSRF: What's the Difference?

XSS injects malicious script into a trusted site so it runs in the victim's browser, abusing the user's trust in the site. CSRF tricks an authenticated user's browser into sending an unwanted request to a site, abusing the site's trust in the user's browser.

Cross-Site Scripting (XSS)

Full definition
vs

Cross-Site Request Forgery (CSRF)

Full definition
Cross-Site ScriptingCross-Site Request Forgery
Trust exploitedUser trusts the websiteWebsite trusts the user's browser/session
Attacker code runs on target site?Yes, script executes in the site's contextNo, only a forged request is sent
Typical goalSteal cookies/tokens, deface, keylogChange email, transfer funds, change settings
Requires victim logged in?Not necessarilyYes
Primary defensesOutput encoding, input validation, CSP, HttpOnly cookiesAnti-CSRF tokens, SameSite cookies, re-authentication
Can read response?YesNo, blind
Remember it

XSS runs the attacker's code; CSRF borrows the victim's session.

Exam tip

If the payload contains script tags, it is XSS. If the scenario describes a hidden form or image tag that silently triggers an action on another site, it is CSRF.

Tested on

More Application & OT Security look-alikes