I know about cross-site scripting and cross-site request forgery. I want to know if there is any similarity between them?

  • 1
    A quora answer to a very similar question. Commented Oct 27, 2018 at 7:11
  • 2
    I think that user13695 is arrogant and patronizing here. There are sensible differences between the two class of attacks. While the below answer points out the similitudes there are differences in the way the attacker injects scripts and disguises them
    – MiniMe
    Commented Feb 27, 2021 at 1:07

1 Answer 1


In a cross-site request forgery attack, the attacker tries to force/trick you into making a request which you did not intend. This could be sending you a link that makes you involuntarily change your password. A malicious link could look like that:


In a cross-site scripting attack, the attacker makes you involuntarily execute client-side code, most likely Javascript. A typical reflected XSS attacking attempt could look like this:


Both attacks have in common that they are client-side attacks and need some form of user activity (e.g. clicking a link or visiting a website). Unlike RFI or SQLi vulnerabilities, you're attacking a user rather than the server. XSS is generally more powerful than CSRF because it usually allows the execution of arbitrary script code while CSRF is restricted to a particular action (e.g. changing the password). As @Lukas points out, a successful XSS attack also effectively bypasses all anti-CSRF measures.

  • 5
    Good answer! I'd like to add that each most XSS vulnerabilities could also be used to exploit CSRF vulnerabilities.
    – Lukas
    Commented Oct 6, 2016 at 20:30
  • 2
    Would it be right to say, CSRF sends an illegitimate request to perform some operation on the server and XSS sends an illegitimate request so that the response runs client side attack code?
    – ProgramCpp
    Commented Jun 6, 2017 at 7:04
  • 2
    @ProgramCpp Kind of. XSS is not necessarily about sending a single "illegitimate" request. E.g., with a persistent XSS vulnerability, the attacker could also prepare an attack independent from the victim. But yes, CSRF is about performing an operation, XSS is about running client-side attack code.
    – Arminius
    Commented Jun 6, 2017 at 8:39
  • For more information about "a successful XSS attack also effectively bypasses all anti-CSRF measures", I think that this is a good resource: owasp.org/index.php/… Commented Feb 5, 2019 at 11:20

Not the answer you're looking for? Browse other questions tagged .