Security

XSS, CSRF and Content Security Policy.

📄️Cross-Site Scripting (XSS)

Stored, reflected and DOM-based XSS, escaping by context, sanitization, XSS in React, Trusted Types

How CSRF works, why CORS does not stop it, SameSite cookies, CSRF tokens, Origin and Fetch Metadata checks

Content-Security-Policy header, directives and source values, strict CSP with nonces and strict-dynamic, Report-Only, frame-ancestors