Lesson 208
Web Security
SOP · Injection · XSS · CSRF
1:00Why the web is hard to lock down — and how to prevent SQL injection, XSS, CSRF, and other top application-layer attacks.
By the end, you can
- Explain why every byte from the client is treated as attacker-controlled.
- State the three components of a browser origin and identify when two URLs are same-origin or cross-origin.
- Describe how SQL injection turns user input into executable SQL and prevent it with parameterized queries.
- Distinguish reflected, stored, and DOM-based XSS by how the payload reaches the victim.
- Apply output encoding and name two additional XSS defense layers (CSP and HttpOnly cookies).
- Trace the CSRF attack flow and explain why anti-CSRF tokens and SameSite cookies defeat it.
- Identify the top three OWASP Top 10 (2021) categories and state the purpose of the list.
- Correct the misconception that HTTPS alone prevents injection, XSS, or CSRF.
Up next in Information Theory, Cryptography & Security
