Client-Side Vulnerabilities

CSRF makes a victim's browser send a state-changing request to your site from an attacker's page; cookies ride along automatically, so the server sees a legitimate user. The endpoint is vulnerable when it authenticates by cookie alone and needs no unguessable value.

Reflected XSS echoes attacker input back in the response; stored XSS persists it and serves it to every viewer; DOM XSS never reaches the server — client script writes untrusted data into a sink. All three run in your origin and act as the user.

Echoing the request Origin into Access-Control-Allow-Origin together with credentials lets any site read authenticated responses from your API. null is not a safe sentinel — sandboxed iframes send it — so allowlist exact origins instead of reflecting.

SameSite=Lax or Strict stops cookies riding cross-site requests — cheap, but a browser default, not a per-request check. A synchronizer token is server-stored and verified per request, the strongest option. Double-submit is stateless but subdomain control weakens it.

Start at the sources — location.hash, location.search, document.referrer, postMessage data — and follow the value to sinks that parse or execute it, such as innerHTML, document.write and eval. Any unsanitised source-to-sink path is the bug.

Each sink parses differently — HTML text needs entity encoding, attributes need quoting, JavaScript strings need JS escaping, URLs need percent-encoding. HTML-encoded data landing in a <script> block or an href stays executable, so pick the encoder by destination.

The same-origin policy protects you by default; CORS only relaxes it, so a permissive config is the vulnerability, not a defense. It governs what a browser lets script read — non-browser clients ignore it. The preflight checks method and headers, never authorisation.

The browser runs only scripts the policy allows. A per-response random nonce on your own <script> tags, or a sha256 hash pinning exact content, marks them — injected script carries neither. unsafe-inline allows every inline script, including the injected one.

Any window can post to yours, so the handler must compare event.origin against an exact expected origin before acting — never a substring test — and the sender should target a specific origin, not *. Even then event.data is data, so render it with textContent.

Clickjacking loads your page in a transparent frame over attacker content, so the victim's click lands on your real button while they believe they clicked elsewhere. Control framing with the frame-ancestors directive, keeping X-Frame-Options for old browsers.

Without it the opened page gets a window.opener handle to your tab and can navigate it to a phishing copy of your login page — reverse tabnabbing. rel=noopener severs that handle; rel=noreferrer also drops the Referer. Set it explicitly on rendered links.

An inline script without a nonce reached the DOM although this route ships none, so it was injected client-side — DOM XSS. The search term flows from the URL into the results header through a parsing sink. CSP blocked and reported it; fix the sink, not the policy.

Two defects. The handler never checks event.origin, so any window can drive it, and it writes user text into innerHTML, a parsing sink. Compare event.origin to https://app.example.com exactly and return on mismatch, then render with textContent.

A recursive merge that copies attacker keys can write through __proto__, adding a property every plain object then inherits. Alone it is inert — it becomes a bug when a gadget reads that property as configuration, such as a template option or an HTML sink.

The handshake is an HTTP upgrade that carries cookies but is not governed by CORS, so an attacker's page can open a socket as the logged-in user and read the stream. Validate Origin server-side against an allowlist and authenticate with a short-lived token.

Ship Content-Security-Policy-Report-Only first with a report endpoint and let real traffic enumerate every inline handler and third-party host. Then strip inline onclick and eval, move code to external files, add per-response nonces, and enforce once reports flatline.