How do CSRF and XSS differ, and which one JWT in a header avoids?
PICTURE THIS: A SENTENCE BECOMES TOKENS
The model does not read letters like humans. It reads these pieces, then predicts the next one.
Simple meaning
XSS injects script into a page the user trusts and can steal tokens or act as the user.
WHY — Auth instead of guessing?
Why interviewers care about Auth:
question about Auth.
trade-offs, and what you would actually do on a Backend project - not buzzwords.
Name the idea, why it exists, then one short example.
End with when you use it and one common pitfall.
STEPS — What happens with tokens?
Before the model can read a sentence, it goes through these steps:
- 1XSS injects script into
a page the user trusts and can steal tokens or act as the user.
- 2CSRF tricks the browser
into sending existing cookies to your API without the user's intent.
- 3A bearer JWT in
an Authorization header is not sent automatically by the browser, so classic CSRF is weaker
- 4XSS can still steal
that token from memory or storage.
- 5Next token
The model scores what should come next.
- 6Decode
IDs turn back into readable text.
EXAMPLE — See it in action
Let's see how a real sentence is tokenized (tokens may vary by model):
Note: Actual tokens and IDs depend on the tokenizer (e.g., GPT, Llama, etc.).
Key takeaway
XSS injects script into a page the user trusts and can steal tokens or act as the user. CSRF tricks the browser into sending existing cookies to your API without the user's intent.