Backend
XSS vs CSRF: stealing identity vs abusing it
XSS executes malicious code inside your user's browser. CSRF tricks your user's browser into making requests they never wanted. The key difference in one line.
How it actually works
The engineering questions you get asked, and the bugs you actually hit. Drawn, one mechanism at a time, in the order the videos ship.