#csrf

XSS vs CSRF: Two Browser Attacks With Two Different Fixes

XSS runs the attacker's code on your page. CSRF makes the browser send a request you didn't mean to. Each cookie flag stops only one of them.