What’s on the XSS & CSRF poster
XSS — injected script against CSRF — forged request, side by side.
- XSS — injected script: Attacker's JavaScript runs on your page
- XSS — injected script: Stored, reflected or DOM-based
- XSS — injected script: Steals tokens, rewrites the page
- XSS — injected script: Fix: escape on output, by context
- XSS — injected script: Fix: Content-Security-Policy header
- CSRF — forged request: A different site makes the user's browser act
- CSRF — forged request: Uses cookies the browser sends automatically
- CSRF — forged request: No script on your site required
- CSRF — forged request: Fix: SameSite cookies
- CSRF — forged request: Fix: anti-CSRF token per form
- XSS defeats every CSRF defence — once attacker script runs on your origin, it can rea…
Escape on output, not on input: the correct escaping depends on where the value lands — HTML, attribute, URL or JavaScript.
Questions about the XSS & CSRF poster
- What’s on the XSS & CSRF poster?
- XSS — injected script against CSRF — forged request, side by side. XSS — injected script: Attacker's JavaScript runs on your page; XSS — injected script: Stored, reflected or DOM-based; XSS — injected script: Steals tokens, rewrites the page; XSS — injected script: Fix: escape on output, by context; XSS — injected script: Fix: Content-Security-Policy header; CSRF — forged request: A different site makes the user's browser act; CSRF — forged request: Uses cookies the browser sends automatically; CSRF — forged request: No script on your site required; CSRF — forged request: Fix: SameSite cookies; CSRF — forged request: Fix: anti-CSRF token per form; XSS defeats every CSRF defence — once attacker script runs on your origin, it can rea…. Escape on output, not on input: the correct escaping depends on where the value lands — HTML, attribute, URL or JavaScript.
- Who is the XSS & CSRF poster for?
- XSS & CSRF belongs to the Computing section rather than to a school year, because computing is not something one grade owns. Anyone learning security can pin it up — a beginner, a student mid-course, or someone revising years later.
- When should you use the XSS & CSRF poster?
- XSS runs attacker code on your site. CSRF makes your user's browser act without their intent. A wall chart earns its place by being glanceable from where the work is happening, so XSS & CSRF belongs on the wall where that computing work actually happens, within glancing distance, rather than filed away.
- What other posters go with XSS & CSRF?
- Secrets, AuthN vs AuthZ and Hashing vs Encryption sit alongside XSS & CSRF in the Computing section. Printed together they make a wall rather than a single sheet, which is how a reference set actually gets used.SecretsAuthN vs AuthZHashing vs Encryption
- Is the XSS & CSRF poster free to download and print?
- Yes. XSS & CSRF downloads as a free PDF with no account, no email and no watermark, like everything else in the Computing section. Print as many copies as you like for a home, a classroom, a library or a tutoring group; reselling the file is the only thing the licence rules out.Read the licence
- What size does the XSS & CSRF poster print at?
- XSS & CSRF is a vector PDF laid out for US Letter, and prints on A4 with Fit to page — the same file, no separate download. Because every mark on it is drawn rather than photographed, it stays sharp enlarged to A3, A2 or A1 at a copy shop. Colour carries emphasis only, so a greyscale print of XSS & CSRF loses nothing.Printing guide
Related posters
Charts that sit alongside XSS & CSRF on the same wall.
Browse every Computing poster, or start from the full catalogue.