Security-related web concepts

Key features

• CORS is enforced by the BROWSER, not the server — curl or a Python script ignores it entirely; only a page running in a browser is restricted
• Access-Control-Allow-Origin on the response is the core header — either a specific origin or "*" (any origin, no credentials allowed)
• "Simple" requests (GET/POST with plain form content types) go straight through; other requests trigger a preflight OPTIONS request first
• A preflight OPTIONS request asks "would you accept this?" before the real request is sent — the server answers with Access-Control-Allow-Methods/-Headers
• Access-Control-Allow-Credentials: true is required (alongside a SPECIFIC origin, never "*") for a cross-origin request to send/receive cookies

Command

# a minimal, framework-agnostic CORS response for one specific origin
def cors_headers(origin: str) -> dict:
    allowed = {'https://app.example.com'}
    if origin not in allowed:
        return {}
    return {
        'Access-Control-Allow-Origin': origin,
        'Access-Control-Allow-Methods': 'GET, POST',
        'Access-Control-Allow-Credentials': 'true',
    }

Key features

• CSRF exploits that a browser automatically attaches cookies to ANY request to that domain — including one initiated by a hidden form on an unrelated malicious page
• A CSRF token is a random, per-session (or per-form) value the server requires in the request BODY — an attacker's page cannot read it to include it, since reading requires a cross-origin fetch the same-origin policy blocks
• SameSite=Lax/Strict cookies are a complementary defense: the browser itself withholds the cookie on many cross-site requests, independent of any token
• CSRF specifically targets STATE-CHANGING requests (POST/PUT/DELETE) — a GET should never change state, so CSRF on a pure GET is a design bug, not just a missing token
• secrets.compare_digest() (not ==) should compare a submitted CSRF token against the expected one, to avoid a timing side-channel

Command

import secrets

def generate_csrf_token() -> str:
    return secrets.token_urlsafe(32)

def verify_csrf_token(submitted: str, expected: str) -> bool:
    return secrets.compare_digest(submitted, expected)   # constant-time, not ==

Key features

• Reflected XSS: malicious input comes from the current request (a URL parameter) and is echoed straight back into the response
• Stored XSS: malicious input is saved (a comment, a profile field) and rendered later to OTHER users who never submitted anything
• DOM-based XSS: the vulnerability is entirely client-side JavaScript writing untrusted data into the DOM, never touching the server at all
• HTML-escaping untrusted output (converting < > & " ' to entities) is the core defense — every major template engine (Jinja2, Django templates) auto-escapes by default
• A Content-Security-Policy header is defense in depth: it can block inline <script> execution even if an escaping bug slips through

Command

import html

user_input = '<script>alert(1)</script>'
safe = html.escape(user_input)
print(safe)   # &lt;script&gt;alert(1)&lt;/script&gt; -- inert text, not a tag

Key features

• TLS provides three things: encryption (contents unreadable in transit), integrity (tampering is detectable), and authentication (the certificate proves you are talking to the real server)
• An origin is the exact triple scheme + host + port — https://api.example.com and http://api.example.com are DIFFERENT origins (scheme differs), as are :443 and :8443 (port differs)
• The same-origin policy blocks a script on one origin from reading (not necessarily sending) a response from another origin — CORS is the controlled, opt-in exception to this
• HTTPS protects data IN TRANSIT only — it does nothing to stop XSS, SQL injection, or a CSRF-forged request, all of which happen inside an already-encrypted connection
• HSTS (Strict-Transport-Security header) tells a browser to never attempt plain HTTP to this host again for a set duration, closing the window for an initial-request downgrade attack

Command

import ssl, httpx

with httpx.Client(verify=True) as client:   # verify=True is the default -- validates the cert chain
    response = client.get('https://api.example.com/data')
    # a self-signed or expired cert here raises httpx.ConnectError, connection refused before any data moves