Web Security Basics

Defensive concepts for keeping untrusted values from becoming executable markup or script.

Term / Syntax	Name	Description	Example
textContent	Safe text insertion	Inserts text without parsing it as HTML.	message.textContent = userValue;
innerHTML	HTML parser boundary	Parses a string as markup; avoid inserting untrusted strings.	container.innerHTML = trustedTemplate;
escaping	Context-aware output	Encodes special characters appropriately for the destination context.	Render untrusted text as text, not concatenated HTML.
sanitization	Remove unsafe markup	Uses a trusted sanitization approach when user-controlled HTML must be allowed.	Sanitize allowed HTML before insertion.

Browser concepts involved in protecting sessions and credentials.

Term / Syntax	Name	Description	Example
HTTPS	Encrypted transport	Protects HTTP traffic in transit and authenticates the server using TLS.	https://example.com
Secure cookie	HTTPS-only cookie	Prevents a cookie from being sent over insecure HTTP.	Set-Cookie: session=...; Secure
HttpOnly cookie	Script-inaccessible cookie	Prevents client-side JavaScript from reading the cookie.	Set-Cookie: session=...; HttpOnly
SameSite	Cross-site cookie policy	Controls when cookies are included with cross-site requests.	Set-Cookie: session=...; SameSite=Lax

Policies and browser boundaries that reduce common attack surfaces.

Term / Syntax	Name	Description	Example
CSP	Content Security Policy	Restricts which sources can load or execute content.	Content-Security-Policy: default-src 'self'
CORS	Cross-origin resource sharing	Controls which origins browser scripts may use to access a response.	Access-Control-Allow-Origin: https://example.com
CSRF	Cross-site request forgery	An attack where a user's authenticated browser is tricked into sending an unwanted state-changing request.	Use appropriate SameSite cookies and server-side CSRF defenses.
rel=noopener	Opener isolation	Prevents a newly opened page from receiving a reference to the opening window.	target="_blank" rel="noopener noreferrer"

Rules of thumb for data stored or shipped to the browser.

Term / Syntax	Name	Description	Example
localStorage	Persistent origin storage	Stores strings accessible to JavaScript on the origin; do not treat it as secret storage.	localStorage.setItem("theme", "dark");
sessionStorage	Tab-scoped storage	Stores strings for the lifetime of the browser tab/session.	sessionStorage.setItem("draft", value);
API secret	Server-side secret	Private credentials must not be embedded in browser-delivered source code.	Keep private API keys on trusted server-side infrastructure.
dependency audit	Dependency hygiene	Review and update dependencies to reduce known-vulnerability exposure.	npm audit