web
7 articles with this tag
What is CORS — how it works, and what a misconfiguration exposes
CORS is how the browser controls whether another origin's JS can read your API responses. A misconfiguration — reflecting any Origin, or Access-Control-Allow-Origin:* with credentials — lets a third-party site read logged-in data. The real defense: an allowlist, don't blindly reflect Origin, default deny.
What is session fixation — making a victim log in with an ID the attacker already knows
Session fixation makes a victim use an attacker-known session ID, then impersonates them after they log in with it. The real defense: regenerate the session ID on login (and on privilege change). Don't accept IDs from the URL, and harden cookies with HttpOnly/Secure/SameSite.
What is clickjacking — invisible traps that make you click hidden buttons
Clickjacking layers your real site invisibly over an attacker's page so the user performs an unintended action (transfer, settings change, consent). The real defense is refusing to be framed — CSP frame-ancestors plus X-Frame-Options.
What is open redirect — your trusted URL used as a springboard to another site
An open redirect lets a ?next= style parameter forward users to any external site, borrowing your trusted domain for phishing. The real defense: never accept external URLs as redirect targets — relative paths and an allowlist only.
What is path traversal — reading files the server should never serve, via ../
Path traversal mixes ../ into a filename input to escape the base directory and read/write .env, config, or keys. The real defense: never use user input as a raw file path, and normalize-then-confine inside an allowed base directory.
What is XSS (Cross-Site Scripting) — code running in someone else's browser
XSS makes an attacker-supplied string run 'as script' in another user's browser — straight to session theft and impersonation. The real defense is escaping on output. Don't disable your framework's auto-escaping.
What is CSRF (Cross-Site Request Forgery) — making a logged-in user act without meaning to
CSRF makes a logged-in user's browser send an unintended action, abusing the browser's habit of auto-attaching cookies. The real defense is CSRF tokens plus SameSite cookies. Never use GET for state changes.