How do XSS and CSRF differ, and what controls address each?

Cross-site scripting runs attacker-controlled script in a trusted application’s browser context, often through unsafe rendering. Use context-appropriate output encoding, safe DOM APIs, sanitization for permitted rich HTML, and a restrictive content security policy as defense in depth. Cross-site request forgery causes a victim’s browser to send an unwanted authenticated request. Use anti-CSRF tokens where applicable, suitable SameSite cookies, and origin checks. HttpOnly helps protect cookies from script access but does not stop all XSS effects. CORS alone is not a complete CSRF defense.