Web Security Fundamentals
The Web Security Fundamentals domain tests the browser's security model and the defensive coding that follows from it: same-origin policy, injection, session attacks and transport protections.
The same-origin policy
Two URLs share an origin only if scheme, host and port all match. Scripts, images and stylesheets may be included cross-origin, but reading responses is blocked - that is why CORS exists. CORS is a controlled relaxation, not a server-side boundary.
XSS
Cross-site scripting (stored, reflected, DOM-based) injects attacker script into your page. Defend by encoding output for the correct context, preferring textContent over innerHTML, validating input, and sending a Content-Security-Policy such as default-src 'self'; script-src 'self' 'nonce-…'. 'unsafe-inline' largely defeats CSP.
CSRF and cookies
Because cookies ride along automatically, a forged request can act as the user. Use SameSite=Lax or Strict, anti-CSRF tokens, and Origin checks; never allow state changes over GET. Set HttpOnly (blocks JavaScript access) and Secure (HTTPS only); SameSite=None requires Secure.
Other essentials
Parameterise SQL queries to stop injection. Hash passwords with bcrypt or Argon2, never MD5 or SHA-1. Serve everything over TLS with HSTS and avoid mixed content. Prevent clickjacking with frame-ancestors or X-Frame-Options. JWT payloads are readable, not encrypted, and cannot be revoked before expiry - HttpOnly session cookies are often safer.
Worked example
Rendering a username: el.textContent = user.name inserts text and cannot execute. el.innerHTML = '<b>' + user.name + '</b>' executes a payload such as <img src=x onerror=alert(1)>. If markup is genuinely needed, sanitise with a maintained library and keep CSP as a second layer.
Traps
Relying on client-side validation, storing tokens in localStorage next to an XSS hole, and assuming HTTPS prevents scripting bugs.