intermediate
Browser security
Same-origin policy, CORS, CSP, cookies, client storage, and security boundaries enforced by the browser.
Browser security interviews test boundaries the host enforces: origin isolation, cross-origin reads, injection mitigation, cookies, and client storage under XSS.
Subtopics: same-origin policy, CORS, Content Security Policy, cookies, and storage security.
On interviews: distinguish sending a request from reading a response, what CSP limits, and why HttpOnly cookies matter.
Common pitfalls: treating CORS as server auth, permissive CSP wildcards, and access tokens in Web Storage.
The trade-off is convenience versus control — pick the mechanism that matches your coupling and performance budget.
Checklist:
- Define origin by scheme, host, and port.
- Configure CORS and credentials deliberately.
- Layer CSP with escaping and dependency hygiene.
- Classify data before choosing storage.