EXERCISE 2 — Five things XSS can do that CSRF cannot
=====================================================

The fundamental difference: XSS runs ATTACKER CODE same-origin on the target
page; CSRF can only cause the victim's browser to blindly SEND a cross-site
request (write-only, can't read the response). That gap produces these:

1. READ the response of authenticated requests.
   - XSS: runs same-origin, so fetch('/api/account') returns data the script
     can read (balance, messages, personal info) and exfiltrate.
   - CSRF: can send /api/account but the Same-Origin Policy blocks reading the
     response. Write-only -> can't steal the data.

2. STEAL cookies / tokens / localStorage.
   - XSS: reads document.cookie (if not HttpOnly), localStorage,
     sessionStorage -> exfiltrates session tokens.
   - CSRF: never sees the cookie value; the browser attaches it
     automatically but the attacker can't read it.

3. READ the CSRF token and forge a valid request (defeat CSRF defences).
   - XSS: reads the anti-CSRF token from the page/DOM and includes it in a
     same-origin request -> the token check passes. Defeats the defence.
   - CSRF: cannot read the token (cross-site SOP block); that's exactly why
     the synchronizer token stops CSRF.

4. MODIFY the page / capture keystrokes (phishing in place).
   - XSS: rewrites the DOM -- inject a fake login form, add a keylogger
     (addEventListener), deface content -- all on the real, trusted origin.
   - CSRF: runs no code on the page; it cannot alter what the user sees or
     capture input.

5. PERFORM arbitrary multi-step actions as the user, reading results.
   - XSS: scripts a whole sequence (read state -> make decisions -> submit
     forms -> verify success), adapting to responses, invisibly.
   - CSRF: can fire one (or a few) blind, pre-baked requests with no feedback
     and no branching -- it can't read results to chain steps intelligently.

WHY XSS IS RATED MORE SEVERE:
  - Each item above is enabled by SAME-ORIGIN CODE EXECUTION, which XSS has
    and CSRF lacks. XSS is a superset: anything CSRF achieves (sending a
    state-changing request), XSS can also do -- AND it can read responses,
    steal secrets, defeat CSRF tokens, and act interactively.
  - Therefore an app with XSS can't be protected from CSRF (or much else) by
    tokens, because the XSS reads them. XSS is foundational; close it first.