7 lessons

Web Security

The browser is an execution environment an attacker can reach. XSS, CSRF, CORS and the origin model that decides what any of them mean.

AssetThreatAttack SurfaceTrust BoundaryVulnerabilityExploit PathImpactMitigationDefense in DepthResidual Risk

Every lesson below identifies the asset, attacker capability and boundary before naming the vulnerability. Controls are split into prevention, detection and recovery; residual risk is explicit.

Web Security: Browser to Database
▶ lab

Map browser execution, origins, cookies, API decisions and database interpretation onto one end-to-end path.

Boundary · Browser → web application → API → database
Cross-Site Scripting (XSS)
▶ lab

XSS exists when attacker-controlled data crosses into an HTML, attribute, URL or JavaScript context and the browser interprets it as behavior.

Boundary · Untrusted data → browser execution context
XSS Defense by Output Context
▶ lab

Escaping rules depend on whether data enters HTML text, an attribute, a URL or JavaScript; validation alone cannot solve every context.

Boundary · Application output → specific browser parser
Content Security Policy

CSP limits which code a browser may execute, buying a second boundary after an output-encoding defect.

Boundary · Rendered document → executable resource
Cross-Site Request Forgery (CSRF)
▶ lab

A browser can attach ambient credentials to a request initiated by another site; the server mistakes possession of a cookie for user intent.

Boundary · Attacker-controlled origin → credentialed application request
CSRF Defense

Choose defenses from the authentication style: ambient cookies create CSRF exposure; explicit authorization headers change the browser behavior and threat.

Boundary · Cross-origin request → state-changing handler
CORS Without the Myths
▶ lab

CORS is a browser-enforced cross-origin response-reading policy, not server authentication and not protection from non-browser clients.

Boundary · One browser origin → another origin’s response