Lesson overview · Free interview practice

Browser Security

Defend the browser runtime: XSS vectors, CSP, and safe client-side storage.

Topics in the full lesson
  • Introduction to Web Security
  • Cross-Site Scripting (XSS)
  • Cross-Site Request Forgery (CSRF)
  • Content Security Policy (CSP)
  • Other Security Best Practices
  • Exercises

Practice Problems

Work through a question before revealing its explanation. These questions and answers are free; Premium adds the full lesson walkthrough, examples and implementation detail.

Completion marks record your own progress, not an automatically checked result. The task type does not determine whether it is optional.

TheoryEasy

Cross-Site Scripting (XSS): Vectors and Defenses

Question

What is Cross-Site Scripting (XSS), what are the three categories of attack, and what defenses actually work?

Take a moment to think about this before revealing the answer

Explain your reasoning or try an implementation before comparing answers.

TheoryMedium

Cross-Site Request Forgery (CSRF): The Attack and the Token Defense

Question

What is CSRF, why does it work, and how do SameSite cookies and CSRF tokens defeat it?

Take a moment to think about this before revealing the answer

Explain your reasoning or try an implementation before comparing answers.

TheoryMedium

Avoiding `eval` and `innerHTML`: Safe Alternatives

Question

Why are eval, Function, innerHTML, and string-form setTimeout/setInterval security hazards? What's the safe alternative in each case?

Take a moment to think about this before revealing the answer

Explain your reasoning or try an implementation before comparing answers.

TheoryMedium

Content Security Policy (CSP): The XSS Backstop

Question

What is Content Security Policy, how do you write a useful policy, and what does each major directive control?

Take a moment to think about this before revealing the answer

Explain your reasoning or try an implementation before comparing answers.

Explore the full Browser Security material

Premium includes the complete lessons and implementation references. Free practice questions remain available without a subscription.

All course tracks & premium content
From basics to advanced masterclasses
Built for JS/TS developers like you
Real-world tips & common pitfalls
Upgrade to Premium