jargon

Frontend & browser·topic 9 of 13

Browser security

Your code runs on someone else's machine, next to someone else's script, holding someone else's session. These are the attacks that follow from that and the browser features that exist to blunt them.

Read in order · tick what you already know

  1. 01

    someone put a script tag in their display name and it ran in everyone else's browser.

    Cross-site scripting

  2. 02

    the payload was saved in the database and fired for every visitor who opened the page afterwards.

    Stored XSS

  3. 03

    the search term from the query string was echoed back into the page without being escaped.

    Reflected XSS

  4. 04

    the server never saw the payload, because the script read it from the URL fragment and wrote it into the page.

    DOM-based XSS

  5. 05

    the angle brackets in the comment showed up as text on the page instead of becoming a tag.

    Output escaping

  6. 06

    you needed to accept formatted text, so you parsed it and stripped everything not on the allowed list.

    HTML sanitisation

  7. 07

    an injected script was blocked because the browser refused to run anything from an origin not on the list.

    Content Security Policy

  8. 08

    each inline script tag carries a random token that matches the header, and anything without one is refused.

    CSP nonce

  9. 09

    the script tag carries a hash and the browser refuses to run the file if it does not match.

    Subresource integrity

  10. 10

    the session cookie is invisible to `document.cookie`, so a script that gets injected cannot read it.

    HttpOnly cookie

  11. 11

    the cookie stopped being sent when the request came from another site, and an embedded widget broke.

    SameSite cookie

  12. 12

    the embedded iframe could not read its own cookie because it was not the site in the address bar.

    Third-party cookie

  13. 13

    your page was loaded in an invisible iframe over someone else's button, and the click landed on yours.

    Clickjacking

  14. 14

    you embedded untrusted content and stripped its ability to run scripts, submit forms or navigate the top window.

    iframe sandbox

  15. 15

    you opened a link in a new tab and the other site could reach back and navigate the tab you came from.

    noopener

  16. 16

    the `?next=` parameter accepted an absolute URL and sent users straight off to another site after login.

    Open redirect

  17. 17

    the HTTPS page tried to load an image over HTTP and the browser blocked it silently.

    Mixed content

  18. 18

    typing the bare hostname went straight to HTTPS with no HTTP request made at all.

    HSTS

  19. 19

    the API key is in the bundle, which means it is in everyone's browser and in their devtools.

    Client-side secret