Browser security

Prevent XSS at the output boundary

Choose text rendering, context-aware encoding, or deliberate HTML sanitization according to how the browser will interpret the value.

Development · Developers

Protect cookie-authenticated actions against CSRF

Make the server distinguish an intended action from a request another site caused the browser to send.

Development · Developers, AppSec engineers

Configure CORS and CSP around the browser capabilities you need

Control who can read API responses and which resources a page may execute without confusing either control with authorization.

Development · Developers, AppSec engineers

Render rich text without granting it application privileges

Choose text rendering or a restricted HTML policy, then test the final DOM after every transformation.

Development · Developers, AppSec engineers

Prevent DOM XSS, postMessage abuse and client-side injection

Trace attacker-controlled values from the URL, messages and storage to the browser APIs that parse HTML or run code, then close those sinks with safe APIs, a sanitizer, Trusted Types and strict message checks.

Development · Developers, AppSec engineers

Configure HTTP security headers from a tested baseline

Send the response headers that make browsers enforce HTTPS, run only your own scripts, refuse hostile framing and keep cookies on one host, then prove they appear on every kind of response.

Development · Developers

Case study: the polyfill.io CDN takeover (2024)

How the sale of the polyfill.io domain and project in February 2024 turned a script tag on more than 100,000 websites into a channel for malicious redirects by June, why Subresource Integrity could not have protected it, and the controls that would have.

Development, Maintenance, Security program · AppSec engineers, Platform engineers and SREs

Apply security limits to GraphQL, WebSocket and gRPC operations

Carry authorization and resource budgets past the initial HTTP request into resolvers, messages and long-lived streams.

Development, Maintenance · Developers, Platform engineers and SREs

Operate TLS and certificates: configuration, renewal and verification

Configure a modern TLS profile with hybrid post-quantum key exchange, automate renewal for certificate lifetimes that fall to 47 days, and verify every termination point with a fresh handshake.

Design, Maintenance · Developers, Platform engineers and SREs

CSRF lab: Protect an account change from a forged request

An account settings handler trusts the session cookie even when another site causes the request. Repair the request policy and preserve legitimate settings updates.

XSS lab: Render a model’s answer as text instead of active markup

A report page shows generated answers with a link to the cited source. The renderer inserts both as HTML, so an answer containing an image handler becomes active markup and a javascript: source becomes a clickable script. Repair the text serializer and the DOM renderer.

CORS policy lab: Grant CORS to the right origins only

An API reflects whatever Origin a request carries and allows credentials, so any website can read a signed-in user’s data from it. Repair the CORS policy so it grants access only to the configured origins and keeps caches correct.

CSP builder lab: Build a strict Content-Security-Policy

A page sends a Content-Security-Policy whose script-src allows any HTTPS origin, so an injected external script runs despite the nonce. Repair the builder so it produces a strict nonce-based policy from the document’s declared needs.

HTML sanitization lab: Configure a sanitizer for user comments

A comment feature keeps the formatting users submit, but its sanitizer configuration re-enables event handlers, unknown URL schemes and extra tags, so a comment can run script. Repair the configuration so only a small set of formatting tags and safe links survive.

Cross-site request forgery (CSRF)

Cross-site request forgery happens when a server accepts a state-changing request because it carries the user's session cookie.

CORS misconfiguration on credentialed APIs

A CORS misconfiguration lets a page on another origin read an API's responses with the user's cookies.

Clickjacking

Clickjacking (a UI redress attack) happens when a sensitive page can be loaded in a frame by another site, which overlays a decoy so a victim's click lands on the real control.