The browser is a security boundary, but it trusts the pages it loads. Two attack families abuse that trust: cross-site scripting (XSS) and cross-site request forgery (CSRF).
XSS: running attacker code in a trusted page
- Stored XSS saves the payload on the server, so every visitor is affected.
- Reflected XSS bounces input straight back in the response.
- DOM XSS occurs when client-side JavaScript writes untrusted data into a dangerous sink.
The impact is the same: the script runs with the site's origin, can read the DOM, make requests as the user and steal data the page can access.
Defences:
- output encoding for the correct context (HTML, attribute, URL, JavaScript);
- a strict Content Security Policy;
- avoid dangerous sinks such as
innerHTMLwith untrusted data; - framework auto-escaping, used correctly.
CSRF: making the browser act
CSRF tricks a logged-in user's browser into sending a state-changing request to another site. The browser attaches cookies automatically, so the request looks authenticated.
Defences:
SameSite=LaxorStrictcookies;- CSRF tokens tied to the session;
- origin and referer checks for state-changing requests;
- avoid state changes on GET.
Match the attack description to the defence that most directly addresses it.
No timer. Accuracy matters more than speed.
Key takeaways
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.