CSRF, XSS and CSP

No single security field solves every threat.

UnderstandStudy an examplePractise

Understand the concept

CSRF triggers unwanted actions through automatically attached browser credentials. Design SameSite, anti-forgery tokens and origin checks for the actual flow. Do not change business state through GET.

XSS executes attacker code in page context. Use context-aware encoding, safe rendering and sanitisation. CSP limits sources and execution; nonce/hash policies can help, while a broadly unsafe policy does not offer equivalent protection.

Report-only rollout can expose breakage before enforcement. Policies can block legitimate scripts, fonts or API calls. HttpOnly limits cookie reads but not every authenticated action. CORS, CSP and CSRF protections address different problems.

WHEN TO USE IT

Design layered browser and API protection.

COMMON PITFALL

Replacing XSS prevention with a CSP header.

01 / PRACTICE

One topic. Three levels of depth.

HTTP / illustrative example

State-changing GET: avoid

Preserve safe method semantics.

This page does not send requests to external servers. Messages are readable HTTP/1.1 illustrations, not HTTP/2 or HTTP/3 wire dumps. example.test is reserved for examples. Run commands and JavaScript only in your own test environment; never publish real tokens or cookies.

02 / YOUR TURN

Try it yourself first.

Does allowing CORS make CSRF tokens unnecessary?

Show the solution and explanation

Worked solution

Different threat models

No; evaluate CSRF protection against credential and state-changing flows.

RasimAtaberkŞahin

Understand the concept

One topic. Three levels of depth.

Try it yourself first.