Summary
XSS — attacker runs script in victim's origin; mitigate with output encoding, CSP, Trusted Types, sanitization (DOMPurify). CSRF — attacker triggers authenticated actions from another site; mitigate with SameSite cookies, CSRF tokens, custom headers requiring preflight. XSS steals sessions; CSRF abuses them. Never store secrets in localStorage for XSS-sensitive apps. Align with .cursor/rules/security.mdc.
Code example
<meta http-equiv="Content-Security-Policy"
content="default-src 'self'; script-src 'self' 'nonce-abc123'" />
<!-- CSRF token on state-changing forms -->
<input type="hidden" name="_csrf" value="token-from-server" />
Key points
- XSS — attacker runs script in victim's origin; mitigate with output encoding, CSP, Trusted Types, sanitization (DOMPurify).
- CSRF — attacker triggers authenticated actions from another site; mitigate with SameSite cookies, CSRF tokens, custom headers requiring preflight.
- XSS steals sessions; CSRF abuses them.
- Never store secrets in localStorage for XSS-sensitive apps.
- Align with
.cursor/rules/security.mdc.