https://krash.dev/tags/web-security/Recent content in Web-Security on krash.devHugoen-usFri, 14 Aug 2026 08:29:09 +0530https://krash.dev/posts/xss-vs-csrf/Tue, 28 Jun 2022 00:00:00 +0000https://krash.dev/posts/xss-vs-csrf/<p>An interesting discussion, led me to realize this is one of the commonly discussed topic and I thought a blog post for it might be helpful for someone.</p> <p><a href="https://portswigger.net/web-security/csrf" target="_blank" rel="noopener noreferrer">Cross-site request forgery</a> and <a href="https://portswigger.net/web-security/cross-site-scripting" target="_blank" rel="noopener noreferrer">Cross-site scripting</a> are both client side attacks which performs action on behalf of users.</p> <p>Just some context here -</p> <ul> <li><a href="https://portswigger.net/web-security/cross-site-scripting" target="_blank" rel="noopener noreferrer">Cross-site scripting</a> (or XSS) allows an attacker to execute arbitrary JavaScript within the browser of a victim user. The attack happen because of the acceptance of the malicious code by the sites.</li> <li><a href="https://portswigger.net/web-security/csrf" target="_blank" rel="noopener noreferrer">Cross-site request forgery</a> (or CSRF) allows an attacker to induce a victim user to perform actions that they do not intend to. This attack can be performed by the code hosted on any third party attacker controlled site.</li> </ul> <p>Before diving into the differences, let&rsquo;s see what conditions needs to be met in order for both the attacks to be successful.</p>