XSS vs CSRF vs CORS?
Practice this questionWANT TO UNDERSTAND THE CONCEPT FIRST?Learn XSS vs CSRF vs CORS?
Definition:
XSS, CSRF and CORS concern browser trust but refer to different mechanisms. XSS runs attacker-controlled script in a trusted page, CSRF triggers requests with automatically attached credentials, and CORS controls whether browser code may read cross-origin responses. A defense for one does not automatically solve the others.
Key points:
-
XSS runs unwanted script in a page; use safe rendering and sanitize required HTML.
-
CSRF abuses automatically sent credentials; protect state-changing requests with CSRF controls.
-
CORS controls browser response access; it is not an authorization system.
-
HttpOnly cookies reduce token reading by scripts, but malicious script may still act through the logged-in page.
Interview point:
- Explain the attacker's capability and the browser behavior being abused before naming a defense.
Adapted from 08_PERFORMANCE_SECURITY.md · “XSS vs CSRF vs CORS?”. Code examples are study fragments. Difficulty and core labels are editorial estimates; version-specific behavior should be checked against your project.