Lesson 03 · 14 min
XSS and CSRF: output encoding, CSP, SameSite
Three kinds of XSS, why React does not fully save you, Content Security Policy and protecting forms from CSRF.
14 minLesson 3 of 5Practice includedAsk AI on any point
XSS (cross-site scripting): foreign JavaScript runs on your page in the context of your domain. It sees the same things your code sees: the DOM, the user's data, and it can make requests on the user's behalf. CSRF (cross-site request forgery) works the other way around: a foreign site makes the user's browser send a request to your site together with the user's cookies.
Sign in to continue
The rest of this lesson opens after sign up
The first lesson of every course is open without an account. To read on, solve the practice and use Ask, create a free account or log in.