Cross-Site Scripting (XSS)
XSS occurs when an application includes untrusted user input in a web page without sanitization. If a user pastes a script tag that renders in another client's browser, the script runs in the context of that user's session, allowing session token theft.
Defense: Context-aware output encoding and strict Content Security Policies (CSP).
Cross-Site Request Forgery (CSRF)
CSRF tricks a logged-in user's browser into executing unwanted actions on an application where they are authenticated. Because browsers append session cookies automatically to requests, a malicious link on domain A can trigger a form submission on domain B.
Defense: SameSite cookie attributes and unique anti-CSRF challenge tokens.
Server-Side Request Forgery (SSRF)
SSRF occurs when a server takes a user-supplied URL and fetches it without validation. An attacker can pass localhost paths (e.g. http://169.254.169.254/metadata) to access internal metadata services, cloud keys, or private database ports.
Defense: Allowlist external domains, disable loopback/local routing, and run fetches in isolated sandbox containers.