Web Security / Intermediate: browser and data interpretation defenses

Web Security β€” Intermediate: browser and data interpretation defenses

Keep text, query, request, origin, file, and outbound retrieval contracts explicit and verifiable.

6 lessons Β· No account required

What you will learn

  • Choose contextual encoding and structured interpreter interfaces.
  • Distinguish CSRF and CORS under the actual credential model.
  • Constrain uploads and server retrieval across their full lifecycle.

  1. Output encoding and XSS prevention

    Keep untrusted values as data at each rendering context and distinguish encoding, sanitization, and template trust.

    Start learning

  2. Injection prevention through data separation

    Keep values separate from query, command, and template structure, and review the permissions of the interpreter itself.

    Start learning

  3. CSRF and request authenticity

    Protect state-changing browser requests under the actual credential model without confusing CORS, HttpOnly, or authentication with user intent.

    Start learning

  4. CORS, origins, and credentialed browser access

    Define cross-origin response sharing without treating browser policy as authentication, CSRF protection, or a server-to-server boundary.

    Start learning

  5. Uploads and the complete file lifecycle

    Treat uploaded content, names, storage, processing, and download access as connected defensive boundaries.

    Start learning

  6. SSRF and server-side outbound boundaries

    Constrain server-initiated retrieval through destination policy, supported clients, network controls, and bounded responses.

    Start learning
Back to course