Step 3 / Select topic Frontend Security Easy

What this bank covers

• createTextNode is a safe way to show user input
• location.hash as a DOM XSS source
• textContent escapes markup on read-back
• Sources are attacker-controlled data reads
• insertAdjacentHTML is an HTML sink
• Checking URL schemes before assigning href
• Escaping HTML special characters
• window.name as a persistent source
• className is not an HTML sink
• Escape ampersands first
• innerHTML does not execute scripts
• Regex stripping is reassemblable
• Checking URL schemes
• Event attributes survive parsing
• Template content is inert
• Protocol-relative URLs pass scheme checks
• The parser normalizes markup
• Attribute names are case-insensitive
• Stripping <script> does not remove event handler attributes
• host vs hostname
• Substring checks are not host checks
• Resolving a root-relative URL
• url.origin
• Userinfo before the host
• Repeated query parameters
• Automatic query encoding
• Protocol allowlisting
• Mutating a parsed URL
• Protocol-relative URLs inherit only the scheme
• Origin strings drop default ports and paths
• Functions are not cloneable
• Choosing the right targetOrigin
• targetOrigin format
• What event.origin contains
• Strict origin equality in a message handler
• Structured clone limits
• Prefix origin checks
• Parsing string message data
• Default ports in origin strings
• Recursive merge is the classic pollution sink
• Object.create(null) ignores prototype pollution
• JSON.parse does not call the __proto__ setter
• Freezing Object.prototype blocks the write
• JSON.stringify only serializes own properties
• `in` sees the prototype chain, hasOwn does not
• Pollution hijacks missing option defaults
• Map entries are not property lookups
• DOM attributes are not read from the prototype chain
• Prototype pollution via recursive merge
• startsWith('/') is not a local-path check
• Prefix matching on origins
• Exact-match allowlists for redirects
• Userinfo tricks in redirect URLs
• Backslashes are normalised to slashes
• Decoding happens after validation
• Dangerous schemes in redirect targets
• Resolve, compare origin, fall back
• Suffix checks on whole URLs
• Backslashes in redirect targets
• default-src fallback
• Nonces disable 'unsafe-inline'
• Report-only header
• Which directives inherit default-src
• Host-source matching
• What 'self' means
• Wildcard host-sources
• Policies delivered by meta
• 'unsafe-eval'
• Restricting embedding
• Secure vs HttpOnly
• Attribute that blocks script access
• document.cookie exposes only name=value
• SameSite values
• SameSite=None requires Secure
• Domain attribute scope
• Cookie path matching
• Deleting cookies with Max-Age=0
• Session cookies vs persistent cookies
• The CORS allow-origin header
• Wildcard origin and credentials
• The preflight method
• Exposing response headers
• Preflight request headers
• Simple requests skip the preflight
• Origin comparison
• Caching preflight results
• Safelisted Content-Type values
• The Origin request header
• X-Frame-Options values
• frame-ancestors 'none'
• Framing directives in CSP
• Reading sandbox tokens
• Detecting framing
• Choosing a frame-ancestors source
• Obsolete X-Frame-Options syntax
• X-Frame-Options must be a real header
• Sandbox is an allowlist
• textContent is not an HTML sink
• Reading a value out of a cookie string
• iframe sandbox re-enables features one token at a time