How Browsers Work · Part 11 — The Security Model
The browser's defenses: the same-origin policy, CORS, Content Security Policy, cookie protections (SameSite/HttpOnly), the sandbox and site isolation, and how they combine to contain hostile code.
Filter/Tag
#csp
5 entries
-
-
Service Workers · Phần 18 — Bảo mật service worker
Vì sao SW cần HTTPS và scope quan trọng, những gì tuyệt đối không được cache (Authorization, PII), toàn vẹn nội dung và CSP cho SW, rủi ro chuỗi cung ứng, và cách tránh cache poisoning biến SW thành lỗ hổng.
-
Web Security for Frontend Devs · Part 13 — Strict CSP & CSP Bypasses
Advanced track: why allowlist CSPs get bypassed — JSONP and gadgets on trusted CDNs, open redirects, base-uri hijacks, scriptless exfiltration — and how a nonce + strict-dynamic policy stops them. With a simulator and exercises.
-
Frontend Security Architecture: Browser Model, XSS, CSP, and Defense-in-Depth
How the browser security model, XSS, CSP, isolation headers, and supply-chain controls form a layered defense for modern frontend systems.
-
Web Security for Frontend Devs · Part 3 — Content Security Policy (CSP)
How Content-Security-Policy contains XSS even when sanitization fails: directives, nonces, strict-dynamic, report-only rollout, Trusted Types, and a starter strict policy — with exercises.