What combination of practices helps prevent XSS and CSRF in MIPC web apps?

• A. XSS: only input validation; CSRF: only token validation.
• B. XSS: CSP alone; CSRF: ignore.
• C. XSS prevention: input validation, output encoding, and Content Security Policy; CSRF prevention: anti-CSRF tokens, same-site cookies, and proper session handling.
• D. XSS: ignore; CSRF: ignore.

Answer: (C)

Protecting web apps from XSS and CSRF needs layered protections that cover how data is handled, displayed, and how requests are authenticated. For XSS, the risk comes when untrusted input ends up being executed as code in the browser. Using input validation helps catch obviously malicious data, but you also want output encoding so any user-provided data rendered in HTML, attributes, JavaScript, or CSS is treated as text rather than executable code. A Content Security Policy adds another line of defense by restricting which scripts can run and where they can come from, making it much harder for injected payloads to execute even if some data slips through validation or encoding.

For CSRF, the threat is a user’s browser performing unwanted actions on another site because it automatically sends cookies. Anti-CSRF tokens tie each state-changing request to the user’s session and require the token to match what the server expects, preventing forged requests. SameSite cookies help prevent browsers from sending credentials with cross-site requests, and solid session handling—proper cookie flags, rotation of tokens, and minimizing session hijacking risks—reduces the chance an attacker can exploit a legitimate session.

Putting these together gives a defense-in-depth approach that addresses both classes of vulnerability: data handling and rendering for XSS, and request authenticity and session integrity for CSRF. The other options rely on single measures or neglect CSRF entirely, which leaves gaps that attackers can still exploit.