Web Security and Common Vulnerabilities

Vocabulary flashcards covering core web security concepts, browser security boundaries, and common web application vulnerabilities.

Same-Origin Policy (SOP)

A fundamental security boundary in web browsers that prevents a script from one origin (combination of scheme, host, and port) from accessing or modifying resources from a different origin.

CORS (Cross-Origin Resource Sharing)

An HTTP-header-based mechanism that allows a server to explicitly permit browsers to load resources from origins other than its own.

CSP (Content Security Policy)

A security standard that allows site operators to restrict the resources (such as JavaScript, CSS, and Images) that the browser is allowed to load for a given page, primarily used to prevent code injection.

Sandbox / Sandboxing

An isolated computing environment that separates running programs—often to execute untrusted code or scripts safely—preventing them from harming the host system or network.

SameSite Cookies

A cookie attribute (Strict or Lax) that controls whether cookies are sent along with cross-site requests, helping protect against cross-site request forgery.

XSS (Cross-Site Scripting)

A vulnerability that allows attackers to inject malicious client-side scripts (usually JavaScript) into web pages viewed by other users.

Stored XSS

A type of XSS where the malicious script is permanently saved on the target server (e.g., in a database or comment section).

Reflected XSS

A type of XSS where the script is bounced off a web server instantly, often via a crafted URL or search query.

DOM-based XSS

A vulnerability that exists entirely in the client-side JavaScript, where data from the user is unsafely parsed and written directly to the Document Object Model (DOM).

CSRF (Cross-Site Request Forgery)

An attack that tricks a victim into executing unwanted, authenticated actions on a web application where they are currently logged in.