Re: XSS issue

darrinholst
Fri, 19 Sep 2008 13:57:33 -0000

>
> the javascript would be served from the same website...
> consider a forum...u enter some javascript in comments.....when
> another user opens the forum thread, the javascript u entered would be
> executed...that is the way i suppose how CSRF works...correct me if
> i''m wrong..
> .

You are describing XSS, not CSRF.

XSS is basically getting a script to run when a user views a page,
i.e. your forum comments example.

CSRF, as Jarkko stated, is about sending requests to your server which
are automatically authenticated, usually by the cookie information
that the browser sends for that domain.