Web Security
The browser is an execution environment an attacker can reach. XSS, CSRF, CORS and the origin model that decides what any of them mean.
Every lesson below identifies the asset, attacker capability and boundary before naming the vulnerability. Controls are split into prevention, detection and recovery; residual risk is explicit.
Map browser execution, origins, cookies, API decisions and database interpretation onto one end-to-end path.
XSS exists when attacker-controlled data crosses into an HTML, attribute, URL or JavaScript context and the browser interprets it as behavior.
Escaping rules depend on whether data enters HTML text, an attribute, a URL or JavaScript; validation alone cannot solve every context.
CSP limits which code a browser may execute, buying a second boundary after an output-encoding defect.
A browser can attach ambient credentials to a request initiated by another site; the server mistakes possession of a cookie for user intent.
Choose defenses from the authentication style: ambient cookies create CSRF exposure; explicit authorization headers change the browser behavior and threat.
CORS is a browser-enforced cross-origin response-reading policy, not server authentication and not protection from non-browser clients.