XSS vs CSRF?

XSS injects script into a page that runs in other users' browsers; prevent with output encoding and a Content Security Policy. CSRF tricks a logged-in user's browser into sending an unwanted request; prevent with anti-CSRF tokens and SameSite cookies.