Security threats and mitigation

Cross-Site Request Forgery (CSRF) is an attack where a user is tricked into performing unwanted actions on a web application in which they are authenticated. The attacker sends a crafted, malicious request to the web application using the victim's credentials (such as session cookies), making the request appear legitimate to the server. CSRF attacks generally target state-changing actions on the server, such as updating or deleting user details or data. These actions are dangerous because the web application can't distinguish between a legitimate request from the authenticated user and a malicious, forged request from the attacker. Data-retrieving actions are typically less useful in CSRF attacks because the response goes to the victim’s browser, not directly to the attacker.

Cross-site scripting (XSS) is a security exploit that allows an attacker to inject malicious, client-side code into an otherwise benign and trusted website. This code is executed by the victim and lets the attackers bypass access controls and thereby impersonate the user. These attacks succeed if the web app does not use sufficient validation or encoding. The user's browser can't detect that the malicious script is untrustworthy, and so it allows access to any cookies, session tokens, or other sensitive site-specific information, and it lets the malicious script rewrite the HTML content.