I sometimes confuse the xss vs csrf 😅