I85PREP
⌘ K
CWICP study materials
CWICP study resources

CWICP: Client-Side and Browser Security Testing

CWICP · Work through your exam, one topic at a time.

All guide sections

Client-Side and Browser Security Testing

This domain tests how well you understand the browser as a security boundary: origin isolation, script execution, framing, and cross-origin data access. Expect questions that require you to decide whether a behavior is exploitable given browser enforcement rules, not just whether a header is missing.

Core mechanisms

  • XSS. Reflected, stored, and DOM-based (source-to-sink in client code: location.hash into innerHTML). Context determines the payload: HTML body, attribute, JavaScript string, URL, CSS. HttpOnly limits cookie theft but not session riding or keylogging.
  • CSP. A real control only without unsafe-inline, unsafe-eval, or wildcard sources; script-src 'self' plus a JSONP endpoint or an open upload on the same origin is often bypassable.
  • CORS. Access-Control-Allow-Credentials: true combined with an origin reflected from the Origin header allows cross-origin reads of authenticated data. ACAO: * with credentials is rejected by browsers, so it is not the bug worth reporting.
  • CSRF. Requires an ambient credential; SameSite=Lax blocks cross-site POSTs but not top-level GET navigations; token validation must be server-side and per-session.
  • Framing and clickjacking. X-Frame-Options or CSP frame-ancestors; note that frame-ancestors is ignored in meta tags.
  • postMessage, WebSockets, service workers. Missing origin checks on message handlers; WebSocket handshakes not validating origin; service workers persisting XSS.
  • Client-side storage and redirects. Tokens in localStorage are readable by any XSS; open redirects enable OAuth token theft.

Worked example

A page issues GET /api/me with cookies, and the response carries Access-Control-Allow-Origin: https://attacker.example and Access-Control-Allow-Credentials: true - the origin value is copied from the request's Origin header. Reasoning: the browser will let a page on attacker.example read the JSON body of /api/me with the victim's cookies attached, which is a full account-data disclosure. Confirm by observing the reflected header for an arbitrary origin and the absence of any allowlist logic. Fix is an exact allowlist and no credential sharing with untrusted origins.

Traps that cost marks

  • Reporting a missing X-XSS-Protection header as a vulnerability - it is deprecated and can introduce issues.
  • Calling ACAO: * with credentials exploitable; browsers block that combination.
  • Assuming HttpOnly stops all XSS impact.
  • Treating a CSP header's presence as protection without auditing its sources.