CORS controls which browser origins may read responses; it is not authentication. CSRF tricks a browser into sending an authenticated request, typically with cookies. XSS executes attacker-controlled script in your origin. Allow only known CORS origins, methods, and headers; never combine wildcard origins with credentials. For cookie authentication, use SameSite plus an antiforgery token on state-changing requests. Prevent XSS with contextual output encoding, safe DOM APIs, a restrictive Content-Security-Policy, and sanitized HTML only when rich text is necessary. Mark session cookies Secure and HttpOnly. Validate authorization on the server because none of these browser controls prevents direct API calls.
Backbencher Developer · · 0 likes