Skip to lesson
Exit
Application Security & Secure Code Review1 / 2

1 min lesson

XSS and CSRF

For each case in "XSS and CSRF", name the signal and the response you would use.

Step 1 of 2

XSS and CSRFthe browser-trust pair

XSS runs attacker JavaScript in a victim's session: stored (saved to the DB and served to everyone), reflected (echoed from the request) or DOM-based (client-side code writes untrusted data into the page). CSRF is the inverse - it rides the victim's existing session to make a state-changing request they didn't intend.

XSS guardrails

React/JSX and modern templating autoescape by default, which kills most reflected and stored XSS for free.

They stop saving you the moment you reach for dangerouslySetInnerHTML, innerHTML or v-html. That's where you look first.

CSRF guardrails

SameSite=Lax cookies (now the browser default) blunt classic cross-site CSRF on top-level navigations.

Anti-CSRF tokens or requiring a custom header on state-changing requests close the gap. Pure token-in-header auth (no cookies) sidesteps CSRF entirely.