While the whole method of XSS and CSRF attacks are totally different, the main difference is that:

XSS - Runs a Script on the brwoser

CSRF - Sends a (HTTP) request from the browser.

Is correct (a Yes or No answer will suffice)?



Exactly. The XSS (Cross Site Scripting) try to execute in some way a script on victim's browser. It can be reflected, stored, etc.

The CSRF (Cross Site Request Forgery) try to use a victim's already logged cookie/session to perform any action on a web.


  • Thanks. Wasn't sure if that was the basic difference or if I totally misunderstood the concept.
    – DrDoom
    Jun 16 '17 at 13:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.