I know about cross-site scripting and cross-site request forgery. I want to know if there is any similarity between them?

  • 1
    A quora answer to a very similar question. Oct 27 '18 at 7:11
  • 2
    I think that user13695 is arrogant and patronizing here. There are sensible differences between the two class of attacks. While the below answer points out the similitudes there are differences in the way the attacker injects scripts and disguises them
    – MiniMe
    Feb 27 at 1:07

In a cross-site request forgery attack, the attacker tries to force/trick you into making a request which you did not intend. This could be sending you a link that makes you involuntarily change your password. A malicious link could look like that:


In a cross-site scripting attack, the attacker makes you involuntarily execute client-side code, most likely Javascript. A typical reflected XSS attacking attempt could look like this:


Both attacks have in common that they are client-side attacks and need some form of user activity (e.g. clicking a link or visiting a website). Unlike RFI or SQLi vulnerabilities, you're attacking a user rather than the server. XSS is generally more powerful than CSRF because it usually allows the execution of arbitrary script code while CSRF is restricted to a particular action (e.g. changing the password). As @Lukas points out, a successful XSS attack also effectively bypasses all anti-CSRF measures.

  • 5
    Good answer! I'd like to add that each most XSS vulnerabilities could also be used to exploit CSRF vulnerabilities.
    – Lukas
    Oct 6 '16 at 20:30
  • 2
    Would it be right to say, CSRF sends an illegitimate request to perform some operation on the server and XSS sends an illegitimate request so that the response runs client side attack code?
    – ProgramCpp
    Jun 6 '17 at 7:04
  • 2
    @ProgramCpp Kind of. XSS is not necessarily about sending a single "illegitimate" request. E.g., with a persistent XSS vulnerability, the attacker could also prepare an attack independent from the victim. But yes, CSRF is about performing an operation, XSS is about running client-side attack code.
    – Arminius
    Jun 6 '17 at 8:39
  • For more information about "a successful XSS attack also effectively bypasses all anti-CSRF measures", I think that this is a good resource: owasp.org/index.php/… Feb 5 '19 at 11:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.