StackScholar

Security

CSRF

Tricking a logged-in user's browser into making an unintended state-changing request.

Why interviewers ask about it

It exists because cookies are sent automatically. Token-based auth in a header is not vulnerable in the same way - which is the trade against HttpOnly cookies.

Related terms

Cookie vs localStorage

Cookies are sent automatically with matching requests and can be HttpOnly; localStorage is script-only and never transmitted.

XSS

Injecting script into a page so it runs with the site's origin and privileges.

This term is part of the free Python Full-Stack interview preparation module - browse the full glossary for every definition.