Skip to main content

Web & Networking Foundations · A05:2021 - Security Misconfiguration

The Browser Security Model: CORS, CSP, and Security Headers

Build on the Same-Origin Policy you already know — learn how CORS lets servers selectively relax it, how CSP adds defense-in-depth against XSS, and how to read these controls from real response headers.

Before we begin, here is exactly what you will be able to do by the end of this lesson.

By the end of this lesson, you will be able to:

  • Read security response headers — Content-Security-Policy, Access-Control-Allow-Origin, and anti-framing headers — directly from a real application in DevTools, and treat their absence as a security finding.
  • Explain how CORS lets a server selectively relax the Same-Origin Policy for trusted cross-origin API calls, and describe why a misconfigured CORS policy (reflected origin with credentials) is a data-exfiltration risk.
  • Apply the SOP read/send distinction to explain precisely why CSRF works even with the browser's isolation rules in place.
  • Name the HTTP header that restricts which scripts and resources the browser may load, and explain why it provides defense-in-depth against XSS rather than a root fix.

When you are ready, send Continue.